CVE-2026-103685

MediumCVSS 4.3

Published: 10/10/2026(UTC)Updated: 13/10/2026(UTC)Translated: 11/10/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.19%

8th percentile - higher than 8% of all known CVEs

Summary

The VillaTheme ALD – Dropshipping and Fulfillment for AliExpress and WooCommerce plugin through version 2.2.4 has a missing authorization vulnerability. It allows exploitation of incorrectly configured access control security levels.

Risk Assessment

An attacker can exploit misconfigured access control, potentially leading to unauthorized access to functions or data.

Recommendation

Update the ALD – Dropshipping and Fulfillment for AliExpress and WooCommerce plugin to a version later than 2.2.4.

Other vulnerabilities in ALD – Dropshipping and Fulfillment for AliExpress and WooCommerce

CVE-2026-57352Medium
The ALD – Dropshipping and Fulfillment for AliExpress and WooCommerce plugin version 2.2.0 and earlier contains a vulnerability allowing an unauthenticated attacker to break the authentication mechanism. This flaw enables bypassing the login process and gaining unauthorized access to administrative functions.

Original NVD description (English source)

Missing Authorization vulnerability in VillaTheme ALD – Dropshipping and Fulfillment for AliExpress and WooCommerce woo-alidropship allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects ALD – Dropshipping and Fulfillment for AliExpress and WooCommerce: from n/a through 2.2.4.

Vulnerability data from NVD (NIST) · CISA KEV · EPSS