Is CVE-2026-57352 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-57352 being exploited in the wild.

How severe is CVE-2026-57352?

Medium severity, with a CVSS score of 4.8, published 2 July 2026.

Is there a fix for CVE-2026-57352?

A patch was published on 2026-07-02: NVD publication and confirmation of fix in version 2.2.1 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-57352 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2026-57352?

Check whether you run VillaTheme ALD – Dropshipping and Fulfillment for AliExpress and WooCommerce at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-57352: VillaTheme ALD Dropshipping broken authentication

CVE-2026-57352 · Severity: medium · CVSS 4.8 · Published 2026-07-02

The ALD plugin for WordPress, which helps store owners manage dropshipping from AliExpress, contains a security flaw in its authentication mechanism. An unauthenticated attacker could exploit this to perform actions that should be restricted to authorized users. In some scenarios, this could lead to unauthorized access to administrative functions or site data.

Vendors: VillaTheme.

Quick answers

Is CVE-2026-57352 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-57352 being exploited in the wild.
How severe is CVE-2026-57352?: Medium severity, with a CVSS score of 4.8, published 2 July 2026.
Which products and versions are affected?: VillaTheme ALD – Dropshipping and Fulfillment for AliExpress and WooCommerce <= 2.2.0.
Is there a fix for CVE-2026-57352?: A patch was published on 2026-07-02: NVD publication and confirmation of fix in version 2.2.1 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-57352 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2026-57352?: Check whether you run VillaTheme ALD – Dropshipping and Fulfillment for AliExpress and WooCommerce at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

The ALD – Dropshipping and Fulfillment for AliExpress and WooCommerce plugin for WordPress (versions 2.2.0 and below) suffers from a broken authentication vulnerability (CWE-1390). The flaw exists in the plugin's identification and authentication logic, allowing unauthenticated remote attackers to bypass intended access controls. While the attack complexity is rated as high, successful exploitation could allow an attacker to execute functions typically reserved for higher-privileged users, potentially leading to administrative account takeover. The issue is resolved in version 2.2.1.

Affected products

VillaTheme ALD – Dropshipping and Fulfillment for AliExpress and WooCommerce <= 2.2.0

Timeline

2026-06-10: disclosed: Reported by Ananda Dhakal via Patchstack
2026-07-01: advisory: Patchstack advisory published
2026-07-02: patched: NVD publication and confirmation of fix in version 2.2.1

References

https://patchstack.com/database/wordpress/plugin/woo-alidropship/vulnerability/wordpress-ald-dropshipping-and-fulfillment-for-aliexpress-and-woocommerce-plugin-2-2-0-broken-authentication-vulnerability?_s_id=cve

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.