Syncee Global Dropshipping Vulnerabilities

The Syncee Premium Dropshipping & Wholesale plugin for WordPress is vulnerable to unauthorized access due to a missing capability check on a function in versions up to, and including, 1.0.27. This makes it possible for unauthenticated attackers to perform an unauthorized action.

CVSS:

5.3

Affected:

up to 1.0.27

Fixed in:

1.0.28

Disclosed:

Jun 18, 2026

CVE-2026-54846 on NVD →

[en] The Syncee WordPress plugin before 1.0.10 leaks the administrator token that can be used to take over the administrator's account.

Affected:

up to 1.0.10

Fixed in:

1.0.10

Disclosed:

Dec 5, 2022

CVE-2022-3694 on NVD →

The Syncee – Global Dropshipping plugin for WordPress is vulnerable to to Missing Authorization to Sensitive Information Disclosure in versions up to, and including, 1.0.9. This is due to a missing capability check on the /wp-json/syncee/supplier/v1/getDataForFrontend REST-API endpoint. This makes it possible for unaut...

CVSS:

4.3

Affected:

up to 1.0.9

Fixed in:

1.0.10

Disclosed:

Oct 27, 2022

CVE-2022-3694 on NVD →