CVE-2024-4450: The AliExpress Dropshipping with AliNext Lite plugin for WordPress is vulnerable to unauthorized access due to a missing capability check on several functions…

PriorityP337medium6.3CVSS 3.1

AVNACLPRLUINSUCLILAL

EPSS

0.33%

25.2th percentile

The AliExpress Dropshipping with AliNext Lite plugin for WordPress is vulnerable to unauthorized access due to a missing capability check on several functions in the ImportAjaxController.php file in all versions up to, and including, 3.3.6. This makes it possible for authenticated attackers, with subscriber-level access and above, to perform several actions like importing and modifying products. CVE-2024-37210 is likely a duplicate of this issue.

Affected

2 ranges

Vendor	Product	Version range	Fixed in
ali2woo	aliexpress_dropshipping_plugin_for_woocommerce_wordpress	<= 3.3.6	—
ali2woo	aliexpress_dropshipping_with_alinext	< 3.3.7	3.3.7

CVSS provenance

nvdv3.16.3MEDIUMCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L

vendor_oracle7.5HIGH

Stop checking back — get the weekly exploitation signal.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.