The EPROLO Dropshipping plugin for WordPress suffers from a missing capability check on two AJAX endpoints, wp_ajax_eprolo_delete_tracking and wp_ajax_eprolo_save_tracking_data, in all releases through 2.3.1. This defect lets an authenticated user with the Subscriber role or higher modify or delete shipping‑tracking records tied to orders. The vulnerability therefore represents a data integrity and authorization bypass; attackers can alter or remove shipping details, potentially disrupting fulfillment processes and eroding customer confidence.

The flaw affects WordPress sites that have installed the EPROLO Dropshipping plugin from the paulepro2019 project, specifically all versions up to and including 2.3.1. Sites running this plugin, regardless of additional themes or plugins, are susceptible to the described data‑tamper attack.

Scored 4.3 on the CVSS scale, the issue carries a low exploitation probability with an EPSS score of less than 1%. It is not currently listed in CISA’s KEV catalog. Because the flaw requires an authenticated user with at least Subscriber privileges, the attack vector is limited to legitimate logins or user credential compromise. An attacker could use standard AJAX calls to the exposed endpoints without triggering additional security checks, making the exploitation relatively straightforward once the prerequisite role is achieved.