CVE-2026-103356
5.4MediumPublished 12 Oct 2026 · NVD status: Deferred · AI triage by gemini-3.8-flash
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- Low
- User interaction
- None
- Impact
- Limited impact
- Weakness
- CWE-862
Impact
Authenticated low-privileged attackers can modify plugin settings or disrupt operations via unauthorized actions. They only need a valid user account with network access to the WordPress site.
Root cause
The plugin fails to perform authorization checks on restricted functionality, permitting access across incorrectly configured privilege levels.
Affected systems
VillaTheme TMDS (tmds-dropshipping-for-temu-and-woo) through 1.0.15
CVSS v3.1 · CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L
Fix & remediation
Upgrade TMDS to a version newer than 1.0.15 once available. If a patched release is not yet published, deactivate the plugin immediately to mitigate risk.
$ wp plugin deactivate tmds-dropshipping-for-temu-and-wooAI-suggested. Run it in staging first and check it against the vendor advisory. Why?
NVD description
Missing Authorization vulnerability in VillaTheme TMDS tmds-dropshipping-for-temu-and-woo allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects TMDS: from n/a through 1.0.15.