{"id":"CVE-2026-119525","kind":"vulnerability","aliases":["CVE-2026-119525"],"related":[],"title":"WordPress Dropshipping XML for WooCommerce: missing access control check","description":"Missing Authorization vulnerability in WP Desk Dropshipping XML for WooCommerce dropshipping-xml-for-woocommerce allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Dropshipping XML for WooCommerce: from n/a through 1.7.4.","summary":"The WP Desk Dropshipping XML for WooCommerce plugin has a missing authorization check that allows access to functions without proper permissions. An attacker may be able to perform actions the site intended only for authorized users.","severity":"medium","cvss":4.3,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["dropshipping-xml-for-woocommerce","package","woocommerce","wordpress"],"not_affected_if":["plugin-not-installed"],"how_to_check":"- Check the installed plugin version in the WordPress admin under Plugins, or look for the `dropshipping-xml-for-woocommerce` plugin folder.\n- Compare the installed version against the affected range through `1.7.4`.","fix":null,"status":"open","published_at":"2026-11-07T11:16:59+00:00","first_seen_at":"2026-11-07T11:46:52+00:00","triaged_at":"2026-11-07T11:48:39+00:00","updated_at":"2026-11-07T11:48:39+00:00","category":"package","confidence":0.5,"triage":{"at":"2026-11-07T11:48:39Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"internet","title":"WordPress Dropshipping XML for WooCommerce: missing access control check","impact":"medium","summary":"The WP Desk Dropshipping XML for WooCommerce plugin has a missing authorization check that allows access to functions without proper permissions. An attacker may be able to perform actions the site intended only for authorized users.","audience":"businesses","category":"package","nicknames":[],"who_cares":["wordpress","woocommerce","dropshipping-xml-for-woocommerce"],"confidence":0.5,"fix_status":"unknown","needs_auth":"unknown","worst_case":"unauthorized users may trigger plugin actions meant for admins","analyst_note":"Confirm the fixed version and which plugin functions lack the authorization check, using the WP Desk advisory or the Wordfence/NVD entry.","how_to_check":"- Check the installed plugin version in the WordPress admin under Plugins, or look for the `dropshipping-xml-for-woocommerce` plugin folder.\n- Compare the installed version against the affected range through `1.7.4`.","plain_action":"","needs_analyst":true,"not_affected_if":["plugin-not-installed"],"who_is_affected":"Sites running the Dropshipping XML for WooCommerce WordPress plugin at version 1.7.4 or earlier, where WooCommerce is used for dropshipping imports. The sources do not state which configurations or roles make the access control gap reachable, so treat any site running the plugin as potentially exposed until the vendor's data is checked.","user_interaction":"unknown","needs_special_setup":"unknown","severity_if_unknown":"medium"},"cost_usd":0.000712,"input_tokens":4246,"output_tokens":575,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-119525':12A,15A '-2026':11A,14A '1.7.4':92C 'abl':49B 'access':7A,39B,79C 'action':52B 'affect':84C 'allow':38B,75C 'attack':46B 'author':35B,58B,61C 'check':9A,36B 'configur':78C 'control':8A,80C 'cve':10A,13A 'desk':26B,65C 'dropship':2A,17B,27B,66C,71C,85C 'dropshipping-xml-for-woocommerc':16B,70C 'exploit':76C 'function':41B 'incorrect':77C 'intend':55B 'issu':83C 'levels.this':82C 'may':47B 'miss':6A,34B,60C 'n/a':90C 'packag':21B 'perform':51B 'permiss':44B 'plugin':31B 'proper':43B 'secur':81C 'site':54B 'user':59B 'vulner':62C 'without':42B 'woocommerc':5A,20B,22B,30B,69C,74C,88C 'wordpress':1A,23B 'wp':25B,64C 'xml':3A,18B,28B,67C,72C,86C","nicknames":[],"mitigations":[],"who_affected":"Sites running the Dropshipping XML for WooCommerce WordPress plugin at version 1.7.4 or earlier, where WooCommerce is used for dropshipping imports. The sources do not state which configurations or roles make the access control gap reachable, so treat any site running the plugin as potentially exposed until the vendor's data is checked.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"none","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["dropshippingxmlforwoocommerce","medium","package","woocommerce","wordpress"],"campaign_type":null,"search_a":"'-119525':12A,15A '-2026':11A,14A 'access':7A 'check':9A 'control':8A 'cve':10A,13A 'dropship':2A 'miss':6A 'woocommerc':5A 'wordpress':1A 'xml':3A","search_b":"'abl':49B 'access':39B 'action':52B 'allow':38B 'attack':46B 'author':35B,58B 'check':36B 'desk':26B 'dropship':17B,27B 'dropshipping-xml-for-woocommerc':16B 'function':41B 'intend':55B 'may':47B 'miss':34B 'packag':21B 'perform':51B 'permiss':44B 'plugin':31B 'proper':43B 'site':54B 'user':59B 'without':42B 'woocommerc':20B,22B,30B 'wordpress':23B 'wp':25B 'xml':18B,28B","search_c":"'1.7.4':92C 'access':79C 'affect':84C 'allow':75C 'author':61C 'configur':78C 'control':80C 'desk':65C 'dropship':66C,71C,85C 'dropshipping-xml-for-woocommerc':70C 'exploit':76C 'incorrect':77C 'issu':83C 'levels.this':82C 'miss':60C 'n/a':90C 'secur':81C 'vulner':62C 'woocommerc':69C,74C,88C 'wp':64C 'xml':67C,72C,86C","first_public_at":"2026-11-07T11:16:59+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N","cvss_by":"audit@patchstack.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-119525","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-119525","severity":null,"published_at":"2026-11-07T11:16:59+00:00","modified_at":"2026-11-07T11:16:59+00:00","first_seen_at":"2026-11-07T11:46:52+00:00","fetched_at":"2026-11-07T11:46:52+00:00","note":null}],"documents":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}