HANDMADE Dropshipping CVE-2026-112827

Exploitation requires the HANDMADE - Dropshipping for Etsy and WooCommerce plugin (version up to and including 1.0.10) installed and active on a WordPress/WooCommerce site, and an attacker holding a low-privileged authenticated account (CVSS PR:L) that can reach the site over the network (AV:N) with no user interaction (UI:N). The specific plugin feature, endpoint, or configuration that lacks the authorization check is not described in the available sources. Limiting factors: the attacker must first obtain a valid low-privilege account (e.g. an open-registration store), impact is concentrated on availability (A:H) with no confidentiality loss and only limited integrity impact, and the affected product is a niche dropshipping plugin, which narrows real-world exposure.

This is a moderate-severity, moderate-priority issue rather than a top-tier emergency. The vendor-supplied CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:H, 7.1) indicates a network-reachable, low-complexity flaw requiring some authenticated privilege (PR:L) and no user interaction, with no confidentiality impact, low integrity impact, and high availability impact. The vuln.today decision label is 'this_week', consistent with a real but non-critical fix timeline. No CISA KEV listing and no EPSS score are present in the input, so there is no signal of active or widespread exploitation - exploitation status is 'no public exploit identified at time of analysis'. The only reference is a Patchstack database advisory entry (not a working proof-of-concept), so claims of available exploit code would be unsupported. The main tension in the data is that A:H (high availability impact) sits alongside C:N/I:L, suggesting the broken access control primarily lets a low-privileged user invoke a function that can disrupt availability rather than steal or heavily tamper with data; the exact mechanism is not described in the available sources. Overall: a genuine authorization gap worth patching on a normal cycle, but not a high-CVSS-but-illusory issue nor a confirmed in-the-wild threat.

A user who already holds a low-privileged WordPress account (e.g. a registered/subscriber-level user on a store running the HANDMADE dropshipping plugin) sends a crafted request to a plugin endpoint that fails to verify authorization. Because the missing check (CWE-862) allows access beyond their role, the attacker triggers plugin functionality that disrupts site availability. No public exploit code is identified at the time of analysis; the single reference is a Patchstack advisory entry, not a verified working exploit.