CVE-2026-74019

HighCVSS 7.1

Published: 20/08/2026(UTC)Updated: 24/08/2026(UTC)Translated: 20/08/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.21%

11th percentile - higher than 11% of all known CVEs

Summary

Unauthenticated Broken Access Control vulnerability in EPROLO Dropshipping plugin versions up to 2.4.2. An attacker without authentication can access administrative or other protected resources.

Risk Assessment

Potential unauthorized access to plugin settings or data, which may lead to security compromise of the online store.

Recommendation

Update the EPROLO Dropshipping plugin to the latest version that includes a fix.

Other vulnerabilities in EPROLO Dropshipping

CVE-2025-12133Medium
The EPROLO Dropshipping plugin for WordPress is vulnerable to unauthorized data modification due to a missing capability check on the wp_ajax_eprolo_delete_tracking and wp_ajax_eprolo_save_tracking_data AJAX endpoints in all versions up to and including 2.3.1. This allows authenticated attackers with Subscriber-level access and above to modify and delete tracking data.

Original NVD description (English source)

Unauthenticated Broken Access Control in EPROLO Dropshipping <= 2.4.2 versions.

Vulnerability data from NVD (NIST) · CISA KEV · EPSS