CVE-2025-12133 describes a missing authorization vulnerability in the EPROLO Dropshipping WordPress plugin by paulepro2019. Specifically, the AJAX endpoints wp_ajax_eprolo_delete_tracking and wp_ajax_eprolo_save_tracking_data do not perform capability checks, allowing authenticated users with low privileges (Subscriber-level and above) to modify or delete tracking data. This vulnerability affects all versions up to and including 2.3.1. The CVSS 3.1 score is 4.3 (medium severity), reflecting the network attack vector, low complexity, required privileges, no user interaction, and impact limited to integrity loss.

An attacker with at least Subscriber-level access to a WordPress site using the vulnerable EPROLO Dropshipping plugin can modify or delete tracking data without authorization. This could lead to data integrity issues affecting order tracking information. There is no impact on confidentiality or availability reported. No known exploits have been observed in the wild.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict user roles to trusted individuals only and monitor for unauthorized changes to tracking data. Avoid granting Subscriber-level access to untrusted users. Follow updates from the plugin vendor for any forthcoming patches.