CVE-2025-12133: 
WordPress vulnerability analysis and mitigation

CVE-2025-12133 is a missing authorization vulnerability in the EPROLO Dropshipping plugin for WordPress that allows authenticated attackers with Subscriber-level access or above to modify and delete order tracking data. It affects all versions of the plugin up to and including 2.3.1. The vulnerability was published on December 5, 2025, and assigned by Wordfence. It carries a CVSS v3.1 base score of 4.3 (Medium) (Red Hat CVE, ENISA EUVD).

The root cause is a missing capability check (CWE-862) on two WordPress AJAX endpoints: wp_ajax_eprolo_delete_tracking and wp_ajax_eprolo_save_tracking_data. Because these endpoints do not verify whether the requesting user has appropriate permissions, any authenticated WordPress user — including those with the lowest default role (Subscriber) — can invoke them directly. Exploitation requires only a valid WordPress account and the ability to send authenticated HTTP requests to the AJAX handler (/wp-admin/admin-ajax.php) with the appropriate action parameter (Red Hat CVE, ENISA EUVD).

Successful exploitation allows a low-privileged authenticated attacker to modify or delete shipment tracking data managed by the EPROLO Dropshipping plugin, directly impacting the integrity of order fulfillment records. There is no confidentiality or availability impact, and the scope is limited to the affected plugin's data. For e-commerce sites relying on this plugin, manipulation of tracking data could disrupt customer order visibility and business operations (Red Hat CVE).

No public proof-of-concept exploit code or evidence of in-the-wild exploitation has been reported for this vulnerability. The EPSS score is approximately 0.026% (0.000260), indicating a very low probability of exploitation in the near term. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. Exploitation requires a valid WordPress account, limiting the attack surface to authenticated users (ENISA EUVD).

1. Obtain a WordPress account: Register or obtain credentials for any WordPress account on the target site, including the lowest-privilege Subscriber role.
2. Authenticate to WordPress: Log in to the WordPress site to obtain a valid session cookie or nonce.
3. Identify the vulnerable AJAX endpoint: Target /wp-admin/admin-ajax.php, which handles WordPress AJAX requests.
4. Send a crafted AJAX request to delete tracking data: Submit an authenticated POST request with action=eprolo_delete_tracking and the target tracking record identifier to delete shipment tracking entries without authorization checks.
5. Send a crafted AJAX request to modify tracking data: Submit an authenticated POST request with action=eprolo_save_tracking_data and arbitrary tracking values to overwrite legitimate shipment tracking information.
6. Achieve objective: Tracking data is modified or deleted, disrupting order fulfillment visibility for the store operator and customers (Red Hat CVE, ENISA EUVD).

• Network: Repeated authenticated POST requests to /wp-admin/admin-ajax.php with action=eprolo_delete_tracking or action=eprolo_save_tracking_data from low-privileged user accounts or unexpected IP addresses.
• Logs: WordPress access logs showing Subscriber-level users invoking EPROLO AJAX actions outside of normal business hours or at high frequency.
• Application: Unexplained deletion or modification of shipment tracking records in the EPROLO plugin's data store without corresponding administrative actions.

Users should update the EPROLO Dropshipping plugin to version 2.3.2 or later, which addresses the missing capability check on the affected AJAX endpoints. As a temporary workaround, site administrators can restrict user registration or limit Subscriber-level accounts if the plugin update cannot be applied immediately. Monitoring AJAX endpoint access logs for anomalous activity from low-privileged accounts is also advisable (ENISA EUVD, Wordfence).