The vulnerability originates from missing authorization checks in the WordPress ALD – Dropshipping and Fulfillment for AliExpress and WooCommerce plugin. The plugin exposes administrative actions that can be invoked without proper role verification, allowing any authenticated user to execute privileged operations. The flaw is a classic broken access control (CWE‑862) that can lead to unauthorized manipulation of orders, products, or plugin configuration.

The issue affects the ALD Dropping and Fulfillment for AliExpress and WooCommerce plugin versions up through 2.2.4. All installations of the plugin, regardless of WordPress configuration, are vulnerable unless the plugin is upgraded. Users who have administrative or editor roles on the WordPress site are specifically at risk because they can reach the vulnerable plugin endpoints.

The CVSS score of 4.3 indicates a medium severity. The EPSS score is not available, so current exploitation probability is unknown. The vulnerability is not listed in CISA KEV, suggesting limited public exploitation or mitigation. Attackers would likely need to authenticate to the WordPress site and then target exposed plugin endpoints. Once accessed, the lack of authorization checks permits execution of any admin‑level action that the plugin offers, such as modifying orders or altering product listings.