CVE-2024-4450: 
WordPress vulnerability analysis and mitigation

CVE-2024-4450 affects the AliExpress Dropshipping with AliNext Lite plugin for WordPress, discovered and disclosed on June 19, 2024. The vulnerability exists in versions up to and including 3.3.5, impacting the ImportAjaxController.php file. This security issue affects WordPress installations using the vulnerable plugin versions (NVD CVE).

The vulnerability stems from a missing capability check on several functions in the ImportAjaxController.php file. The issue has been assigned a CVSS v3.1 base score of 6.3 (MEDIUM) with the vector string CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L. The vulnerability is classified as CWE-862 (Missing Authorization) (NVD CVE).

The vulnerability allows authenticated attackers with subscriber-level access and above to perform unauthorized actions including importing and modifying products. This could potentially lead to unauthorized manipulation of the e-commerce platform's product data (NVD CVE).

The vulnerability requires an authenticated user with at least subscriber-level access to exploit. The attack complexity is considered low, requiring no special conditions or circumstances for exploitation (NVD CVE).

Users should upgrade to version 3.3.7 or later which contains the fix for this vulnerability. The vulnerability has been patched in newer releases of the plugin (NVD CVE).