Eprolo Dropshipping Vulnerabilities

The EPROLO-Dropshipping plugin for WordPress is vulnerable to unauthorized access in all versions up to, and including, 2.4.2. This is due to a missing capability check on a function. This makes it possible for unauthenticated attackers to perform an unauthorized action.

CVSS:

5.3

Affected:

up to 2.4.2

Fix:

No patched version reported

Disclosed:

Aug 20, 2026

CVE-2026-74019 on NVD →

The EPROLO Dropshipping plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the wp_ajax_eprolo_delete_tracking and wp_ajax_eprolo_save_tracking_data AJAX endpoints in all versions up to, and including, 2.3.1. This makes it possible for authenticated attackers, wi...

CVSS:

4.3

Affected:

up to 2.3.1

Fixed in:

2.4.0

Disclosed:

Dec 4, 2025

CVE-2025-12133 on NVD →

The EPROLO Dropshipping plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the eprolo_disconnect, eprolo_reflsh, and eprolo_connect_key functions in versions up to, and including, 1.7.1. This makes it possible for authenticated attackers, with subscriber-level a...

CVSS:

4.3

Affected:

up to 1.7.1

Fixed in:

1.7.2

Disclosed:

Apr 25, 2024

CVE-2024-33573 on NVD →