EUVD-2026-39683
GHSA-fmxq-8fpc-g567
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Unauthenticated network endpoint with missing authorization (AV:N/AC:L/PR:N/UI:N) yields information disclosure only, so C:H but I:N/A:N.
Primary rating from Vendor (patchstack).
CVSS VectorVendor: patchstack
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Lifecycle Timeline
1DescriptionCVE.org
Unauthenticated Broken Access Control in Syncee Premium Dropshipping & Wholesale <= 1.0.27 versions.
AnalysisAI
Sensitive data disclosure in the Syncee Premium Dropshipping & Wholesale WordPress plugin (versions <= 1.0.27) lets remote unauthenticated attackers reach functionality that should be access-restricted, exposing confidential information without any login. Reported by Patchstack and tagged as an authentication bypass, the flaw stems from missing authorization checks (CWE-862) on plugin endpoints. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires that the target WordPress site has the Syncee Premium Dropshipping & Wholesale plugin installed and active at version 1.0.27 or earlier, with the affected endpoint reachable over the network. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The signals are partially complete. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | An attacker enumerates the plugin's registered endpoints on a target WooCommerce/WordPress store and sends a crafted, unauthenticated HTTP request to a Syncee handler that lacks an authorization check. Because no login, nonce, or user interaction is required (AV:N/AC:L/PR:N/UI:N), the server returns data the attacker should not be able to read, such as supplier, catalog, or configuration information. … |
| Remediation | No vendor-released patch version is identified in the available data, so confirm the fixed release directly via the Patchstack advisory (https://patchstack.com/database/wordpress/plugin/syncee-global-dropshipping/vulnerability/wordpress-syncee-premium-dropshipping-wholesale-plugin-1-0-27-broken-access-control-vulnerability?_s_id=cve) and your WordPress plugin updates page, then upgrade to the first release above 1.0.27 as the primary fix. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours: identify all WordPress instances running Syncee Premium plugin versions 1.0.27 and earlier, and disable the plugin immediately. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Same weakness CWE-862 – Missing Authorization
View allSame technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today