The vulnerability permits an attacker to bypass authentication checks in the ALD – Dropshipping and Fulfillment for AliExpress and WooCommerce plugin for WordPress. Because authentication controls can be circumvented, an unauthenticated user could potentially obtain privileges granted to legit users, leading to unauthorized data access or modification. The weakness is a classic broken authentication scenario identified as CWE‑1390.

The affected product is VillaTheme’s ALD plugin for WordPress, specifically all installations of version 2.2.0 or earlier. The plugin is used to connect WooCommerce stores with AliExpress for dropshipping and fulfillment.

The CVSS score of 4.8 indicates a moderate risk level. No EPSS value is available, and the vulnerability is not listed in the CISA KEV catalog. However, since the flaw allows unauthenticated requests to be accepted, the likely attack vector involves standard web traffic to the WordPress site, and an attacker does not need privileged credentials or special conditions to exploit it.