Eprolo Dropshipping
Monthly
Broken access control in the EPROLO Dropshipping WordPress plugin (versions <= 2.4.2) allows network-based attackers to bypass authorization checks and access restricted functionality without proper permission validation. The CWE-862 (Missing Authorization) root cause means the plugin fails to verify whether a requestor has rights to perform certain actions, enabling high-impact confidentiality exposure (C:H) and limited integrity impact (I:L). No public exploit code or active KEV listing is identified at time of analysis, though the unauthenticated nature of the bypass - per the CVE title - makes this accessible to a wide attacker pool.
Broken access control in the EPROLO Dropshipping WordPress plugin (versions <= 2.4.2) allows network-based attackers to bypass authorization checks and access restricted functionality without proper permission validation. The CWE-862 (Missing Authorization) root cause means the plugin fails to verify whether a requestor has rights to perform certain actions, enabling high-impact confidentiality exposure (C:H) and limited integrity impact (I:L). No public exploit code or active KEV listing is identified at time of analysis, though the unauthenticated nature of the bypass - per the CVE title - makes this accessible to a wide attacker pool.