Sharkdropship for AliExpress Dropshipping and Affiliate <= 2.2.4 - Missing Authorization to Unauthenticated Arbitrary Post Deletion
medium
The Sharkdropship for AliExpress Dropshipping and Affiliate plugin for WordPress is vulnerable to unauthorized loss of data due to a missing capability check on the wads_removeProductFromShop() function in all versions up to, and including, 2.2.4. This makes it possible for unauthenticated attackers to delete arbitrary...
- CVSS:
- 5.3
- Affected:
- up to 2.2.4
- Fixed in:
- 2.2.5
- Disclosed:
- Apr 1, 2024
CVE-2024-1732 on NVD →
Sharkdropship for AliExpress Dropship and Affiliate <= 2.2.4 - Missing Authorization
high
The Sharkdropship for AliExpress Dropship and Affiliate plugin for WordPress is vulnerable to unauthorized access and modification of data due to missing capability checks on several functions called via nopriv AJAX actions in the ~/wooshark-aliexpress-importer_init.php file in versions up to, and including, 2.2.4. Thi...
- CVSS:
- 7.3
- Affected:
- up to 2.2.4
- Fixed in:
- 2.2.5
- Disclosed:
- Oct 3, 2023
CVE-2023-30870 on NVD →
Protect your WordPress site
Run a free security scan to detect vulnerable plugins and themes, exposed files, and malware — no plugin install, no signup.
Scan your site free
← Back to the vulnerability database