VillaTheme TMDS EUVD-2026-97291

Exploitation requires an authenticated account on the target WordPress site (CVSS PR:L), meaning at minimum a low-privilege role such as subscriber or WooCommerce customer; it is not exploitable by fully unauthenticated visitors. The site must be running the VillaTheme TMDS (Temu/Woo dropshipping) plugin at version 1.0.15 or earlier. The specific plugin feature or endpoint lacking the authorization check is not named in the available description, so defenders should treat any authenticated-user-reachable TMDS action as potentially affected. Limiting factors: the low-privilege-account prerequisite and the capped impact (no confidentiality loss, only partial integrity and availability) meaningfully reduce real-world risk relative to the raw network-reachable vector.

This is a moderate-severity Missing Authorization flaw (CWE-862) with a vendor-assigned CVSS of 5.4 (AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L). The vector indicates network-reachable, low-complexity exploitation requiring low-level authentication (PR:L) and no user interaction, but with limited impact (no confidentiality, only partial integrity and availability). No EPSS score, CISA KEV listing, or public POC was provided in the input, so there is no public exploit identified at time of analysis and no evidence of active exploitation. The realistic priority is low-to-moderate: the PR:L requirement means an attacker needs at least a low-privileged account (e.g., a subscriber/customer on the WordPress site), and the capped I:L/A:L/C:N impact limits blast radius to data tampering or partial disruption rather than full compromise or data theft. This is a 'patch in normal cycle' issue rather than an emergency, though broken-access-control flaws in e-commerce plugins can expose order/product manipulation. Note a labeling discrepancy: the input Tags include 'Authentication Bypass,' but the CWE-862 classification and the referenced Patchstack title ('broken access control') describe an AUTHORIZATION flaw abused by an already-authenticated low-privilege user, not an authentication bypass - verify the exact access-control gap with the vendor.

A low-privileged authenticated user (such as a registered subscriber or customer) on a WordPress site running the TMDS plugin sends a request to a plugin endpoint that fails to verify the caller's authorization level. Because access control is incorrectly enforced, the user performs an action or modifies data they should not be permitted to, resulting in limited integrity and availability impact. No public exploit code was identified at time of analysis, so exploitation would require an attacker to independently discover the vulnerable endpoint.