WordPress Plugin Vulnerabilities

EPROLO-Dropshipping <= 2.4.2 - Missing Authorization

Description

The EPROLO-Dropshipping plugin for WordPress is vulnerable to unauthorized access in all versions up to, and including, 2.4.2. This is due to a missing capability check on a function. This makes it possible for unauthenticated attackers to perform an unauthorized action.

Affects Plugins

Plugin icon
eprolo-dropshipping
No known fix

References

CVE
CVE-2026-74019
URL
https://www.wordfence.com/threat-intel/vulnerabilities/id/030bb667-b8e6-4987-8af2-83cfa4bed8a6

Classification

Type
NO AUTHORISATION
OWASP top 10
A5: Broken Access Control
CWE
CWE-862
CVSS
5.3 (medium)

Miscellaneous

Original Researcher
hivesec
Verified
No
WPVDB ID
2746a151-3db7-4066-9964-6375cf4341c9

Timeline

Publicly Published
2026-08-20 (about 1 month ago)
Added
2026-08-24 (about 27 days ago)
Last Updated
2026-08-24 (about 27 days ago)

Other

Published
Title
Published
2026-01-24
Title
Download After Email < 2.1.10 - Missing Authorization
Published
2026-09-18
Title
Better Messages < 3.0.0 - Missing Authorization to Authenticated (Custom+) Chat-Room Transcript Disclosure via '/thread/<id>' REST Endpoint
Published
2026-04-03
Title
Pie Register – User Registration, Profiles & Content Restriction < 3.8.4.9 - Missing Authorization to Unauthenticated Registration Form Status Modification
Published
2025-10-27
Title
Insert PHP Code Snippet < 1.4.4 - Missing Authorization
Published
2025-03-06
Title
Golo - Directory & Listing, Travel WordPress Theme < 1.6.11 - Missing Authorization to Privilege Escalation via Unauthenticated Arbitrary User Password Change