EPROLO Dropshipping Missing Authorization Vulnerability in WordPress Plugin

A vulnerability exists in the EPROLO Dropshipping plugin for WordPress, all versions through 2.3.1, allowing unauthorized data modification. This issue arises from a lack of capability checks on the wp_ajax_eprolo_delete_tracking and wp_ajax_eprolo_save_tracking_data AJAX endpoints. As a result, authenticated attackers with Subscriber-level access or higher can alter or delete tracking information.

Impact

Exploitation of this vulnerability enables authenticated users with Subscriber-level access and above to unauthorizedly modify or delete tracking data.