{"id":"CVE-2026-112827","kind":"vulnerability","aliases":["CVE-2026-112827"],"related":[],"title":"HANDMADE Dropshipping WordPress plugin: missing authorization check exposes store actions","description":"Missing Authorization vulnerability in VillaTheme HANDMADE – Dropshipping for Etsy and WooCommerce handmade-dropshipping-for-etsy-and-woo allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects HANDMADE – Dropshipping for Etsy and WooCommerce: from n/a through 1.0.10.","summary":"The HANDMADE Dropshipping for Etsy and WooCommerce WordPress plugin is missing an authorization check, so access control is not enforced on some functions. A low-privileged or unauthenticated user could potentially perform actions reserved for store administrators, per the NVD description.","severity":"high","cvss":7.1,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["etsy-integration","package","woocommerce","wordpress"],"not_affected_if":["plugin-not-installed"],"how_to_check":"- Check the installed plugin version in WordPress admin under Plugins, or in `wp-content/plugins/handmade-dropshipping-for-etsy-and-woo`.\n- Confirm whether the plugin is active on the WooCommerce store.","fix":"- Versions after `1.0.10` are affected only up to that version; the sources do not state a fixed version.","status":"open","published_at":"2026-10-29T11:17:27+00:00","first_seen_at":"2026-10-29T11:24:27+00:00","triaged_at":"2026-10-29T11:25:34+00:00","updated_at":"2026-10-29T11:25:34+00:00","category":"package","confidence":0.5,"triage":{"at":"2026-10-29T11:25:34Z","model":"claude-haiku-5-5","output":{"fix":"- Versions after `1.0.10` are affected only up to that version; the sources do not state a fixed version.","reach":"internet","title":"HANDMADE Dropshipping WordPress plugin: missing authorization check exposes store actions","impact":"medium","summary":"The HANDMADE Dropshipping for Etsy and WooCommerce WordPress plugin is missing an authorization check, so access control is not enforced on some functions. A low-privileged or unauthenticated user could potentially perform actions reserved for store administrators, per the NVD description.","audience":"businesses","category":"package","nicknames":[],"who_cares":["wordpress","woocommerce","etsy-integration"],"confidence":0.5,"fix_status":"unknown","needs_auth":"unknown","worst_case":"unauthorized actions on the store, extent unknown","analyst_note":"Check the NVD entry and the Wordfence or WordPress plugin advisory for affected functions, required privilege, and the first fixed version.","how_to_check":"- Check the installed plugin version in WordPress admin under Plugins, or in `wp-content/plugins/handmade-dropshipping-for-etsy-and-woo`.\n- Confirm whether the plugin is active on the WooCommerce store.","plain_action":"","needs_analyst":true,"not_affected_if":["plugin-not-installed"],"who_is_affected":"Sites running the HANDMADE Dropshipping for Etsy and WooCommerce plugin at version 1.0.10 or earlier. The sources do not describe which specific functions lack the check or what privilege is needed, so the exposure scope is unknown.","user_interaction":"unknown","needs_special_setup":"unknown","severity_if_unknown":"unknown"},"cost_usd":0.000715,"input_tokens":4165,"output_tokens":598,"severity_before":"high"},"analyst_status":null,"analyst_note":null,"search":"'-112827':13A,16A '-2026':12A,15A '1.0.10':102C 'access':38B,87C 'action':10A,56B 'administr':60B 'affect':92C 'allow':83C 'author':6A,35B,66C 'check':7A,36B 'configur':86C 'control':39B,88C 'could':53B 'cve':11A,14A 'descript':64B 'dropship':2A,25B,71C,78C,94C 'enforc':42B 'etsi':18B,27B,73C,80C,96C 'etsy-integr':17B 'exploit':84C 'expos':8A 'function':45B 'handmad':1A,24B,70C,77C,93C 'handmade-dropshipping-for-etsy-and-woo':76C 'incorrect':85C 'integr':19B 'issu':91C 'levels.this':90C 'low':48B 'low-privileg':47B 'miss':5A,33B,65C 'n/a':100C 'nvd':63B 'packag':20B 'per':61B 'perform':55B 'plugin':4A,31B 'potenti':54B 'privileg':49B 'reserv':57B 'secur':89C 'store':9A,59B 'unauthent':51B 'user':52B 'villathem':69C 'vulner':67C 'woo':82C 'woocommerc':21B,29B,75C,98C 'wordpress':3A,22B,30B","nicknames":[],"mitigations":[],"who_affected":"Sites running the HANDMADE Dropshipping for Etsy and WooCommerce plugin at version 1.0.10 or earlier. The sources do not describe which specific functions lack the check or what privilege is needed, so the exposure scope is unknown.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"unknown","audience":"businesses","plain_action":null,"first_public_at":"2026-10-29T11:17:27+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:H","cvss_by":"audit@patchstack.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-112827","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-112827","severity":null,"published_at":"2026-10-29T11:17:27+00:00","modified_at":"2026-10-29T11:17:27+00:00","first_seen_at":"2026-10-29T11:24:27+00:00","fetched_at":"2026-10-29T11:24:27+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}