CVE-2026-57352— WordPress ALD – Dropshipping and Fulfillment for AliExpress and WooCommerce plugin <= 2.2.0 - Broken Authentication vulnerability
Possible ATT&CK Techniques 1AI
T1078 · Valid AccountsAffected Version Matrix 1
| Vendor | Product | Version Range | Status |
|---|---|---|---|
| VillaTheme | ALD – Dropshipping and Fulfillment for AliExpress and WooCommerce | n/a≤ 2.2.0 | affected |
Get alerts for future matching vulnerabilitiesLog in to subscribe
I. Basic Information for CVE-2026-57352
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗ Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
WordPress ALD – Dropshipping and Fulfillment for AliExpress and WooCommerce plugin <= 2.2.0 - Broken Authentication vulnerability
Source: NVD (National Vulnerability Database)
Vulnerability Description
Unauthenticated Broken Authentication in ALD – Dropshipping and Fulfillment for AliExpress and WooCommerce <= 2.2.0 versions.
Source: NVD (National Vulnerability Database)
CVSS Information
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N
Source: NVD (National Vulnerability Database)
Vulnerability Type
CWE-1390
Source: NVD (National Vulnerability Database)
Vulnerability Title
VillaTheme ALD 授权问题漏洞
Source: CNNVD (China National Vulnerability Database)
Vulnerability Description
VillaTheme ALD是VillaTheme公司的一款针对组件功能的产品。 VillaTheme ALD 2.2.0及之前版本存在授权问题漏洞，该漏洞源于认证机制不完善，可能导致未经身份验证的攻击者绕过认证。
Source: CNNVD (China National Vulnerability Database)
CVSS Information
N/A
Source: CNNVD (China National Vulnerability Database)
Vulnerability Type
N/A
Source: CNNVD (China National Vulnerability Database)
Affected Products
| Vendor | Product | Affected Versions | CPE | Subscribe |
|---|---|---|---|---|
| VillaTheme | ALD – Dropshipping and Fulfillment for AliExpress and WooCommerce | n/a ~ 2.2.0 | - |
II. Public POCs for CVE-2026-57352
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POCPremium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2026-57352
请登录查看更多情报信息。
Other References for CVE-2026-57352 (1)
IV. Related Vulnerabilities
Same vendor: VillaTheme
- CVE-2026-11778
CURCY <= 2.2.14 - Unauthenticated Arbitrary Shortcode Execut - CVE-2026-57664
WordPress Bopo – WooCommerce Product Bundle Builder plugin < - CVE-2026-57324
WordPress GIFT4U plugin <= 1.0.10 - Broken Access Control vu - CVE-2026-54809
WordPress GIFT4U plugin <= 1.0.10 - SQL Injection vulnerabil - CVE-2026-39593
WordPress HAPPY plugin <= 1.0.10 - Broken Access Control vul
Same weakness: CWE-1390
- CVE-2026-0274
Cortex XSOAR: Improper Validation of Credentials in Commvaul - CVE-2026-44237
FreePBX: Authenticated Access can lead to Subsequent OAuth2 - CVE-2026-49323
Indian Scout Bobber 2025 WCM-to-ECM weak authentication - CVE-2026-49322
Indian Scout Bobber 2025 Infotainment-to-WCM weak authentica - CVE-2026-40417
Microsoft Dynamics 365 Business Central Elevation of Privile
V. Comments for CVE-2026-57352
No comments yet