Paulepro2019 vulnerabilities

🔔 Create alert RSS

Published CVEs affecting Paulepro2019 products: 2 record(s), with severity, exploitation and fixes.

EPROLO-Dropshipping 2

Exploited only (KEV) →

CVE-2026-74019 High · 7.1 CWE-862 Aug 20, 2026

WordPress EPROLO Dropshipping plugin <= 2.4.2 - Broken Access Control vulnerability

Unauthenticated Broken Access Control in EPROLO Dropshipping <= 2.4.2 versions.

CVE-2025-12133 Medium · 4.3 CWE-862 Dec 5, 2025

EPROLO Dropshipping <= 2.3.1 - Missing Authorization to Authenticated (Subscriber+) Tracking Data Modification

The EPROLO Dropshipping plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the wp_ajax_eprolo_delete_tracking and wp_ajax_eprolo_save_tracking_data AJAX endpoints in all versions up to, and including, 2.3.1. This makes it possible for authenticated attackers, with Subscriber-level access and above, to modify and delete tracking data.