CVE-2024-4450 is a missing authorization vulnerability (CWE-862) in the AliExpress Dropshipping with AliNext Lite plugin for WooCommerce and WordPress. The flaw exists because several functions in ImportAjaxController.php lack capability checks, allowing authenticated users with low privileges (subscriber-level and above) to perform unauthorized actions such as importing and modifying products. This affects all versions up to and including 3.3.6. The vulnerability has a CVSS 3.1 base score of 6.3, indicating a medium severity level. No patch or official remediation guidance has been published yet, and no exploits are known in the wild. CVE-2024-37210 is likely a duplicate of this vulnerability.

An attacker with subscriber-level or higher access to a WordPress site using the vulnerable plugin can bypass authorization controls to import and modify products. This could lead to unauthorized data manipulation within the e-commerce environment, potentially affecting product listings and store operations. The impact is limited to authenticated users but can affect confidentiality, integrity, and availability of product data to a limited extent.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, restrict user roles and permissions to trusted users only, minimizing subscriber-level access where possible. Monitor for updates from the ali2woo plugin vendor and apply patches promptly once available.