EUVD-2026-63319
GHSA-jfmx-9426-2537
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessIdentify WordPress site running EPROLO plugin
-
DeliverySend unauthenticated HTTP request to vulnerable AJAX endpoint
-
ExploitBypass missing authorization check (CWE-862)
-
ExecutionAccess restricted plugin data or functionality
-
ImpactExfiltrate sensitive order or supplier data
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A01:2025 - Broken Access Control
ASVS 5.0
V8 - Authorization Authorization checks on every request
MITRE ATT&CK
1 technique across 1 tactic: Privilege Escalation The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | The EPROLO Dropshipping plugin version 2.4.2 or earlier must be installed and active on a WordPress site. The CVE title states exploitation is 'unauthenticated,' implying no WordPress account is required; however, the provided CVSS vector specifies PR:L (low privileges required), creating a conflict - the actual authentication requirement is not independently confirmed from available data and must be verified against the Patchstack advisory. No special site configuration beyond having the plugin active appears necessary. Exploitation is limited to WordPress installations running this specific plugin; sites not using EPROLO Dropshipping are not affected. |
| Impact | The provided CVSS vector CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N scores 7.1 (High) and implies low privileges (PR:L) are required - yet the CVE description explicitly states 'Unauthenticated' broken access control. This is a direct conflict: if exploitation truly requires no authentication, the correct vector would be PR:N, which would push the score to approximately 8.2. Security teams should treat authentication requirements as unconfirmed until verified against the Patchstack advisory. No EPSS data was provided, no KEV listing exists, and no POC is identified - reducing immediate urgency compared to other High-severity issues. However, the network-accessible, low-complexity, no-user-interaction profile (AV:N/AC:L/UI:N) means exploitation is straightforward once an attacker understands the vulnerable endpoint. For WordPress-hosted e-commerce stores running this plugin, the confidentiality impact (C:H) likely covers exposure of order data, supplier credentials, or customer PII - data classes of regulatory relevance. |
| Exploit ScenarioDerived | An unauthenticated remote attacker (or low-privileged subscriber-level WordPress user, depending on actual exploitation conditions) sends a crafted HTTP request directly to a vulnerable AJAX endpoint registered by the EPROLO Dropshipping plugin. Because the plugin fails to validate the caller's authorization (CWE-862), the endpoint processes the request and returns sensitive data - such as order details, supplier account credentials, or customer information - or performs a restricted modification action. No public POC exists at time of analysis, but the low attack complexity and network accessibility make independent rediscovery feasible for motivated attackers familiar with WordPress plugin auditing. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Aug 20, 2026
Broken access control in the EPROLO Dropshipping WordPress plugin (versions <= 2.4.2) allows network-based attackers to bypass authorization checks and access restricted functionality without proper permission validation. The CWE-862 (Missing Authorization) root cause means the plugin fails to verify whether a requestor has rights to perform certain actions, enabling high-impact confidentiality exposure (C:H) and limited integrity impact (I:L). No public exploit code or active KEV listing is identified at time of analysis, though the unauthenticated nature of the bypass - per the CVE title - makes this accessible to a wide attacker pool.
RemediationAI
No specific patched version number was provided in the available intelligence data, so 'Patch available per vendor advisory' is the appropriate characterization - check the Patchstack entry at https://patchstack.com/database/wordpress/plugin/eprolo-dropshipping/vulnerability/wordpress-eprolo-dropshipping-plugin-2-4-2-broken-access-control-vulnerability for the latest fix version and update the plugin immediately if a newer release exists in the WordPress plugin repository. If a patch is not yet available, compensating controls include: disabling the EPROLO Dropshipping plugin entirely until a fix is released (trade-off: loss of dropshipping integration); using a Web Application Firewall (e.g., Cloudflare, Wordfence) to block requests to the plugin's vulnerable AJAX endpoints (trade-off: requires identifying specific endpoint URLs from the Patchstack report); and restricting access to wp-admin and wp-login.php by IP allowlist to reduce unauthenticated attack surface. Store operators should also audit recent plugin-generated logs for anomalous access patterns that may indicate prior exploitation.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
EPROLO Dropshipping is a WordPress plugin (CPE: cpe:2.3:a:paulepro2019:eprolo_dropshipping) designed to integrate dropshipping supplier functionality into WooCommerce-based WordPress stores. The vulnerability class is CWE-862 (Missing Authorization), meaning one or more plugin actions, endpoints, or AJAX handlers perform sensitive operations without verifying the calling user's role or capabilities against WordPress's capability/nonce system. WordPress plugins commonly register wp_ajax_ or wp_ajax_nopriv_ hooks; the latter is accessible to unauthenticated users by design, making improper use of nopriv hooks a common source of broken access control. The high confidentiality impact (C:H) suggests access to sensitive order, supplier, or customer data managed by the plugin.
Know when Eprolo Dropshipping gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N
CVE title explicitly states unauthenticated access, overriding the provided PR:L; C:H and I:L retained from input; no availability impact described.
Primary rating from Vendor (Patchstack).
CVSS VectorVendor: Patchstack
DescriptionCVE.org
Unauthenticated Broken Access Control in EPROLO Dropshipping <= 2.4.2 versions.
Executive ViewAI
The EPROLO Dropshipping WordPress plugin (versions 2.4.2 and earlier) contains an unauthenticated authorization bypass that allows attackers to access restricted functionality and expose sensitive customer data without credentials. Any organization running this plugin faces immediate risk to data confidentiality and operational integrity of e-commerce systems. Immediate action is required to protect against unauthorized access.
Restrict access to WordPress admin functions through firewall and Web Application Firewall rules limiting access to authorized IP ranges. Enforce strong, unique authentication for all WordPress administrator accounts. Disable the EPROLO plugin temporarily if alternative dropshipping solutions are available. Implement regular vulnerability scanning and access log monitoring to detect exploitation attempts.
Threat Intelligence Overview
NVD
CVE.org
EPSS
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Authentication bypass attacks exploit flaws in the verification mechanisms that control access to systems and applications.
Exploit-DB