CVE-2024-4450

Name of the Vulnerable Software and Affected Versions AliExpress Dropshipping with AliNext Lite plugin for WordPress versions up to, and including, 3.3.5

Description The issue is related to a missing capability check on several functions in the ImportAjaxController.php file. This allows authenticated attackers with subscriber-level access and above to perform actions such as importing and modifying products.

Recommendations For versions up to, and including, 3.3.5, update to a version that includes a fix for the missing capability check in the ImportAjaxController.php file. As a temporary workaround, consider restricting access to the ImportAjaxController.php file to minimize the risk of exploitation.