Unauthorized Data Modification in EPROLO Dropshipping Plugin for WordPress
CVE-2025-12133

4.3MEDIUM

Key Information:

Vendor

WordPress
Status
Eprolo Dropshipping
Vendor
CVE Published:
5 December 2025

What is CVE-2025-12133?

The EPROLO Dropshipping plugin for WordPress has a vulnerability that allows authenticated attackers, with Subscriber-level access or higher, to bypass necessary capability checks on the wp_ajax_eprolo_delete_tracking and wp_ajax_eprolo_save_tracking_data AJAX endpoints. This oversight permits these users to modify and delete tracking data, potentially compromising the integrity of tracking information within the plugin. Users should update to the latest version to mitigate the risks associated with this flaw.

Affected Version(s)

EPROLO Dropshipping * <= 2.3.1

References

https://www.wordfence.com/threat-intel/vulnerabilities/id...
https://wordpress.org/plugins/eprolo-dropshipping/

CVSS V3.1

Score:
4.3
Severity:
MEDIUM
Confidentiality:
None
Integrity:
Low
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Abhirup Konwar
JSON
.
CVE-2025-12133 : Unauthorized Data Modification in EPROLO Dropshipping Plugin for WordPress