The vulnerability permits an attacker to bypass authentication checks in the ALD – Dropshipping and Fulfillment for AliExpress and WooCommerce plugin for WordPress. Based on the description, it is inferred that an attacker could potentially gain the privileges of legitimate users, leading to unauthorized data access or modification. The weakness is a classic broken authentication scenario identified as CWE‑1390.

The affected product is VillaTheme’s ALD plugin for WordPress, specifically all installations of version 2.2.0 or earlier. The plugin is used to connect WooCommerce stores with AliExpress for dropshipping and fulfillment.

The CVSS score of 4.8 indicates a moderate risk level. The EPSS score of < 1% indicates a very low probability of exploitation, and the vulnerability is not listed in the CISA KEV catalog. However, since the flaw allows unauthenticated requests to the WordPress site, and an attacker does not need privileged credentials or special conditions to exploit it.