Ald Dropshipping And Fulfillment For Aliexpress And Woocommerce
Monthly
Authenticated low-privilege users on WordPress/WooCommerce sites running the ALD - Dropshipping and Fulfillment for AliExpress and WooCommerce plugin (woo-alidropship) through version 2.2.4 can reach plugin functionality they are not authorized to use, because affected endpoints omit authorization/capability checks (CWE-862). Per the assessed vector (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N, base 4.3), the practical impact is limited to low-integrity modification - no confidentiality or availability loss - and exploitation requires the attacker to already hold a valid low-privilege account on the target site, so sites that do not allow untrusted user registration have sharply reduced exposure. No public exploit code or confirmed active exploitation was identified at time of analysis, and this remains a low-to-moderate priority issue rather than an emergency patch item.
Broken authentication in VillaTheme's ALD - Dropshipping and Fulfillment for AliExpress and WooCommerce (all versions up to and including 2.2.0) permits remote unauthenticated attackers to bypass authentication controls under high-complexity conditions, yielding limited read and write access to protected plugin functionality. Assigned CVSS 3.1 score of 4.8 with AV:N/AC:H/PR:N, the high attack complexity signals that exploitation requires specific preconditions rather than a trivial request. No public exploit code or active exploitation has been identified at time of analysis, and CISA KEV listing is absent.
Authenticated low-privilege users on WordPress/WooCommerce sites running the ALD - Dropshipping and Fulfillment for AliExpress and WooCommerce plugin (woo-alidropship) through version 2.2.4 can reach plugin functionality they are not authorized to use, because affected endpoints omit authorization/capability checks (CWE-862). Per the assessed vector (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N, base 4.3), the practical impact is limited to low-integrity modification - no confidentiality or availability loss - and exploitation requires the attacker to already hold a valid low-privilege account on the target site, so sites that do not allow untrusted user registration have sharply reduced exposure. No public exploit code or confirmed active exploitation was identified at time of analysis, and this remains a low-to-moderate priority issue rather than an emergency patch item.
Broken authentication in VillaTheme's ALD - Dropshipping and Fulfillment for AliExpress and WooCommerce (all versions up to and including 2.2.0) permits remote unauthenticated attackers to bypass authentication controls under high-complexity conditions, yielding limited read and write access to protected plugin functionality. Assigned CVSS 3.1 score of 4.8 with AV:N/AC:H/PR:N, the high attack complexity signals that exploitation requires specific preconditions rather than a trivial request. No public exploit code or active exploitation has been identified at time of analysis, and CISA KEV listing is absent.