CVE-2025-12133

MediumCVSS 4.3

Published: 05/12/2025(UTC)Updated: 25/09/2026(UTC)Translated: 26/09/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.23%

12th percentile - higher than 12% of all known CVEs

Summary

The EPROLO Dropshipping plugin for WordPress is vulnerable to unauthorized data modification due to a missing capability check on the wp_ajax_eprolo_delete_tracking and wp_ajax_eprolo_save_tracking_data AJAX endpoints in all versions up to and including 2.3.1. This allows authenticated attackers with Subscriber-level access and above to modify and delete tracking data.

Risk Assessment

Attackers with low privileges can manipulate order tracking data, potentially leading to data integrity issues and disruption of logistics processes.

Recommendation

Update the EPROLO Dropshipping plugin to the latest patched version. Additionally, restrict access to AJAX endpoints to trusted roles only.

Other vulnerabilities in EPROLO Dropshipping

CVE-2026-74019High
Unauthenticated Broken Access Control vulnerability in EPROLO Dropshipping plugin versions up to 2.4.2. An attacker without authentication can access administrative or other protected resources.

Original NVD description (English source)

The EPROLO Dropshipping plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the wp_ajax_eprolo_delete_tracking and wp_ajax_eprolo_save_tracking_data AJAX endpoints in all versions up to, and including, 2.3.1. This makes it possible for authenticated attackers, with Subscriber-level access and above, to modify and delete tracking data.

Vulnerability data from NVD (NIST) · CISA KEV · EPSS