CVE-2025-12133: EPROLO Dropshipping Auth Bypass Flaw

CVE-2025-12133 Overview

CVE-2025-12133 affects the EPROLO Dropshipping plugin for WordPress in all versions up to and including 2.3.1. The plugin fails to enforce capability checks on the wp_ajax_eprolo_delete_tracking and wp_ajax_eprolo_save_tracking_data AJAX endpoints. Authenticated users with Subscriber-level access or higher can modify and delete order tracking data. The weakness is classified as Missing Authorization [CWE-862].

Critical Impact

Any authenticated WordPress user, including low-privileged Subscribers, can tamper with or destroy tracking data stored by the EPROLO Dropshipping plugin.

Affected Products

• EPROLO Dropshipping plugin for WordPress
• Versions up to and including 2.3.1
• WordPress sites with Subscriber-level registration enabled

Discovery Timeline

• 2025-12-05 - CVE-2025-12133 published to NVD
• 2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-12133

Vulnerability Analysis

The EPROLO Dropshipping plugin registers two AJAX actions, wp_ajax_eprolo_delete_tracking and wp_ajax_eprolo_save_tracking_data, that handle tracking data operations. Both handlers execute without verifying the caller's WordPress capability. Any authenticated session, including one belonging to a Subscriber, can invoke these actions against /wp-admin/admin-ajax.php and manipulate stored tracking records.

Because the handlers only impact integrity of tracking data, the vulnerability does not permit content disclosure or service disruption. It does allow an attacker to corrupt shipping records, disrupt order fulfillment workflows, and inject arbitrary tracking values that downstream systems may trust.

Root Cause

The root cause is the absence of a current_user_can() capability check and, based on the plugin behavior described in the advisory, missing nonce validation on the two AJAX handlers. WordPress registers wp_ajax_{action} hooks for authenticated requests, so the developer must explicitly gate privileged operations. The plugin instead treats authentication alone as sufficient authorization.

Attack Vector

Exploitation requires a valid WordPress account of at least Subscriber level. The attacker sends a crafted POST request to admin-ajax.php specifying action=eprolo_delete_tracking or action=eprolo_save_tracking_data along with the parameters the handler consumes. The server processes the request and mutates tracking data without checking whether the caller should have that ability. Sites that allow open user registration expose this endpoint to any anonymous visitor who can register an account.

No verified proof-of-concept code has been published. See the Wordfence Vulnerability Report for additional technical context.

Detection Methods for CVE-2025-12133

Indicators of Compromise

• Unexpected POST requests to /wp-admin/admin-ajax.php containing action=eprolo_delete_tracking or action=eprolo_save_tracking_data from low-privileged user sessions.
• Tracking records within the EPROLO plugin data that were modified or removed outside of normal administrator or store-manager activity.
• New Subscriber accounts followed shortly by AJAX activity against EPROLO endpoints.

Detection Strategies

• Review WordPress access logs for admin-ajax.php requests referencing the two vulnerable actions and correlate the originating user role.
• Compare tracking data timestamps against the audit trail of legitimate administrator sessions.
• Alert on any authenticated user session that invokes plugin AJAX actions outside its expected role.

Monitoring Recommendations

• Enable WordPress activity logging to capture user role, IP address, and AJAX action names.
• Forward web server and application logs to a centralized analytics platform for behavioral correlation across sessions.
• Monitor for spikes in new Subscriber registrations followed by AJAX traffic to plugin endpoints.

How to Mitigate CVE-2025-12133

Immediate Actions Required

• Update the EPROLO Dropshipping plugin to a version later than 2.3.1 as soon as the vendor publishes a fixed release.
• Audit existing tracking data for unauthorized modification or deletion.
• Review the WordPress user list and remove untrusted Subscriber accounts.

Patch Information

A plugin changeset addressing the missing capability check is referenced in the WordPress Plugin Changeset. Administrators should confirm they are running a version that includes this fix by consulting the Eprolo Dropshipping Plugin Overview on WordPress.org.

Workarounds

• Disable the EPROLO Dropshipping plugin until an updated version is installed.
• Disable open user registration by unchecking Settings → General → Membership in WordPress.
• Restrict access to /wp-admin/admin-ajax.php for the affected actions using a Web Application Firewall rule.
• Downgrade or remove existing Subscriber accounts that are not required for site operation.

# Example WAF rule concept blocking the vulnerable AJAX actions
# Deny POST requests to admin-ajax.php whose body contains the affected actions
SecRule REQUEST_METHOD "@streq POST" \
  "chain,deny,status:403,id:1012133,msg:'Block EPROLO tracking AJAX (CVE-2025-12133)'"
SecRule REQUEST_URI "@endsWith /wp-admin/admin-ajax.php" "chain"
SecRule REQUEST_BODY "@rx action=(eprolo_delete_tracking|eprolo_save_tracking_data)"