CVE-2026-103685

Received Received - Intake

Missing Authorization in ALD WooCommerce Dropshipping Plugin

Publication date: 2026-10-10

Last updated on: 2026-10-10

Assigner: Patchstack

Description

Missing Authorization vulnerability in VillaTheme ALD – Dropshipping and Fulfillment for AliExpress and WooCommerce woo-alidropship allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects ALD – Dropshipping and Fulfillment for AliExpress and WooCommerce: from n/a through 2.2.4.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-10-10

Last Modified

2026-10-10

Generated

2026-10-11

AI Q&A

2026-10-11

EPSS Evaluated

N/A

NVD

CVE-2026-103685

EUVD

EUVD-2026-96431

Affected Vendors & Products

Vendor	Product	Version / Range
VillaTheme	ALD	– Dropshipping and Fulfillment for AliExpress and WooCommerce 0

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-862	The product does not perform an authorization check when an actor attempts to access a resource or perform an action.

Attack-Flow Graph

Executive Summary

This is a Missing Authorization vulnerability in the VillaTheme ALD plugin for WooCommerce. It allows attackers to exploit incorrectly configured access control security levels, potentially accessing restricted pages or performing unauthorized actions without proper permissions.

Detection Guidance

Check the installed version of the ALD – Dropshipping and Fulfillment for AliExpress and WooCommerce plugin. If it is version 2.2.4 or below, the system is vulnerable. Use WordPress admin panel or run a command like 'wp plugin list' in the WordPress directory to verify the version.

Impact Analysis

An attacker could view other users' data or perform actions they shouldn't be able to. This could lead to data leaks, unauthorized changes, or misuse of the plugin's features. The impact is limited by the low CVSS score of 4.3.

Compliance Impact

This vulnerability could lead to unauthorized access to sensitive user data, which may violate GDPR or HIPAA requirements for data protection and access controls. Organizations using this plugin must address it to maintain compliance.

Mitigation Strategies

Update the ALD – Dropshipping and Fulfillment plugin to version 2.2.5 or later immediately. If updating is not possible, consider disabling the plugin temporarily or seek help from a developer or hosting provider.

Hi! I’m here to help you understand CVE-2026-103685. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70