CVE-2026-112827: WordPress HANDMADE – Dropshipping for Etsy and WooCommerce plugin <= 1.0.10 - Broken Access Control vulnerability

Q: Which versions should be treated as affected?

The affected range is listed as versions through 1.0.10. No earliest affected version is specified.

Q: What does exploitation require and what impact can it have?

The CVSS vector indicates network-reachable exploitation with low attack complexity, low privileges required, and no user interaction. It indicates no confidentiality impact, low integrity impact, and high availability impact.

Published Oct 29, 2026

Updated

Missing Authorization vulnerability in VillaTheme HANDMADE – Dropshipping for Etsy and WooCommerce handmade-dropshipping-for-etsy-and-woo allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects HANDMADE – Dropshipping for Etsy and WooCommerce: from n/a through 1.0.10.

Affected Software

1 affected component

Villatheme HANDMADE – Dropshipping for Etsy and WooCommerce<=1.0.10

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade wordpress/handmade-dropshipping-for-etsy-and-woo to a version that resolves this vulnerability.
Fixed in 1.0.11

Event History

Oct 29, 2026

CVE Published

via MITRE·11:00 AM

Data Sourced

via MITRE·11:00 AM

RemedyDescriptionSeverityWeakness

Frequently Asked Questions

Which versions should be treated as affected?

The affected range is listed as versions through 1.0.10. No earliest affected version is specified.

What does exploitation require and what impact can it have?