CVE-2026-103356: WordPress TMDS plugin <= 1.0.15 - Broken Access Control vulnerability
Missing Authorization vulnerability in VillaTheme TMDS tmds-dropshipping-for-temu-and-woo allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects TMDS: from n/a through 1.0.15.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
wordpress/tmds-dropshipping-for-temu-and-wooto a version that resolves this vulnerability.Fixed in 1.0.16
Event History
Frequently Asked Questions
Who can exploit this issue?
An attacker needs network access and low-level privileges in the affected WordPress environment. No user interaction is required.
Which installations are affected?
VillaTheme TMDS – Dropshipping for Temu and Woo is affected through version 1.0.15. The available data does not identify a fixed version.
What is the potential impact?
The issue may allow unauthorized actions because of incorrectly configured access-control levels. The supplied severity vector indicates low impact to integrity and availability, with no confidentiality impact.