PT-2025-49201 · WordPress · Eprolo Dropshipping

Abhirup Konwar · Published 2025-12-05 · Updated 2025-12-05 · CVE-2025-12133

Positive Technologies (AI Summary)

CVSS v3.1

4.3

Medium

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N

Name of the Vulnerable Software and Affected Versions EPROLO Dropshipping plugin for WordPress versions through 2.3.1

Description The EPROLO Dropshipping plugin for WordPress is susceptible to unauthorized data modification because of a missing capability check. This affects the wp ajax eprolo delete tracking and wp ajax eprolo save tracking data API endpoints. Authenticated attackers with Subscriber-level access or higher can modify and delete tracking data. The vulnerable parameters are not specified.

Recommendations Update the EPROLO Dropshipping plugin to a version beyond 2.3.1.

Fix

Missing Authorization

Weakness Enumeration

CWE-862

Related Identifiers

CVE-2025-12133

Affected Products

Eprolo Dropshipping

References · 7

• https://nvd.nist.gov/vuln/detail/CVE-2025-12133 · Security Note
• https://wordfence.com/threat-intel/vulnerabilities/id/a124da63-01a4-44d8-985b-cacef58ea9a3?source=cve · Note
• https://twitter.com/CVEnew/status/1996841702997610754 · Twitter Post
• https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3412888%40eprolo-dropshipping&new=3412888%40eprolo-dropshipping&sfp_email=&sfph_mail= · Note
• https://twitter.com/VulmonFeeds/status/1996940893807407326 · Twitter Post
• https://wordpress.org/plugins/eprolo-dropshipping · Note
• https://t.me/cveNotify/144841 · Telegram Post