WordfenceCVELIST:CVE-2024-4450CVE-2024-4450 AliExpress Dropshipping with AliNext Lite <= 3.3.5 - Missing Authorization via Several Functions
6.3 Medium
CVSS3
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
LOW
User Interaction
NONE
Scope
UNCHANGED
Confidentiality Impact
LOW
Integrity Impact
LOW
Availability Impact
LOW
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L
0.0004 Low
EPSS
Percentile
13.5%
The AliExpress Dropshipping with AliNext Lite plugin for WordPress is vulnerable to unauthorized access due to a missing capability check on several functions in the ImportAjaxController.php file in all versions up to, and including, 3.3.5. This makes it possible for authenticated attackers, with subscriber-level access and above, to perform several actions like importing and modifying products.
CNA Affected
[
{
"vendor": "ali2woo",
"product": "AliExpress Dropshipping with AliNext Lite",
"versions": [
{
"version": "*",
"status": "affected",
"lessThanOrEqual": "3.3.5",
"versionType": "semver"
}
],
"defaultStatus": "unaffected"
}
]Related
6.3 Medium
CVSS3
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
LOW
User Interaction
NONE
Scope
UNCHANGED
Confidentiality Impact
LOW
Integrity Impact
LOW
Availability Impact
LOW
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L
0.0004 Low
EPSS
Percentile
13.5%