The WordPress TMDS tmds-dropshipping-for-temu-and-woo plugin contains a missing authorization flaw that allows attackers to exploit incorrectly configured access controls. This leads to unauthorized users accessing or performing privileged actions within the plugin, potentially exposing sensitive data or enabling further compromise. The weakness is classified as CWE‑862, Access Control for Resource.

The vulnerability affects the VillaTheme TMDS plugin for WordPress, with all releases through version 1.0.15. Any WordPress site that has the TMDS dropshipping plugin installed and is running a impacted version is potentially exposed.

The CVSS score is 5.4, indicating a moderate severity. The EPSS score is not available, but the lack of a KEV listing suggests it is not yet widely exploited. Attackers are likely to use the web interface of the plugin, leveraging a user account with limited privileges or, if possible, unauthenticated access, to perform the unauthorized operations. The vulnerability requires access to the plugin’s administrative functions and a correct configuration that lacks proper role checks.