EUVD-2026-41351
GHSA-h53w-vp9x-9hfp
Severity by source
AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N
Network vector confirmed by web plugin context; AC:H retained for broken auth bypass requiring specific precondition; PR:N per unauthenticated classification; C:L/I:L per bounded data exposure with no availability impact.
Primary rating from Vendor (Patchstack).
CVSS VectorVendor: Patchstack
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N
Lifecycle Timeline
2DescriptionCVE.org
Unauthenticated Broken Authentication in ALD - Dropshipping and Fulfillment for AliExpress and WooCommerce <= 2.2.0 versions.
AnalysisAI
Broken authentication in VillaTheme's ALD - Dropshipping and Fulfillment for AliExpress and WooCommerce (all versions up to and including 2.2.0) permits remote unauthenticated attackers to bypass authentication controls under high-complexity conditions, yielding limited read and write access to protected plugin functionality. Assigned CVSS 3.1 score of 4.8 with AV:N/AC:H/PR:N, the high attack complexity signals that exploitation requires specific preconditions rather than a trivial request. No public exploit code or active exploitation has been identified at time of analysis, and CISA KEV listing is absent.
Technical ContextAI
The affected product is a WordPress plugin by VillaTheme (CPE: cpe:2.3:a:villatheme:ald_-_dropshipping_and_fulfillment_for_aliexpress_and_woocommerce:*:*:*:*:*:*:*:*) that integrates AliExpress dropshipping order management into WooCommerce-powered WordPress stores. The root cause is classified as CWE-1390 (Weak Authentication), a category covering authentication mechanisms that are absent, insufficiently strong, or bypassable through implementation flaws rather than outright absence. In WordPress plugin contexts, CWE-1390 typically manifests as missing or improperly validated nonces on AJAX endpoints, bypassed capability checks on REST API routes, or broken session/token verification that can be manipulated with crafted HTTP requests. The AC:H assignment in the CVSS vector indicates the authentication bypass is not trivially triggered - a specific request pattern, race condition, or environmental precondition appears necessary. The tag 'Information Disclosure' alongside 'Broken Authentication' suggests at least one exploitable code path exposes protected store or order data.
RemediationAI
Update the ALD - Dropshipping and Fulfillment for AliExpress and WooCommerce plugin to a version above 2.2.0 as soon as a patched release is confirmed available from VillaTheme via the WordPress plugin repository or the vendor site. The Patchstack advisory (https://patchstack.com/database/wordpress/plugin/woo-alidropship/vulnerability/wordpress-ald-dropshipping-and-fulfillment-for-aliexpress-and-woocommerce-plugin-2-2-0-broken-authentication-vulnerability) should be monitored for the confirmed fix version, which was not independently verifiable from the data provided. If a patch is not yet available, consider deactivating the plugin on publicly accessible stores where the dropshipping management interface does not need to be reachable from the internet, and restrict access to WordPress admin and plugin AJAX/REST endpoints via web server rules or a WAF rule targeting the plugin's slug (woo-alidropship). These mitigations reduce attack surface but may impact plugin functionality for legitimate store operators.
Same weakness CWE-1390 – Weak Authentication
View allSame technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today