OPMC vulnerabilities

Products

• WooCommerce Dropshipping 3
• WooCommerce Anti-Fraud 1

Latest OPMC CVEs

Newest publication first

1. CVE-2026-49072 WordPress WooCommerce Anti-Fraud plugin <= 7.2.6 - Broken Access Control vulnerability

   Published 2026-06-17

   Medium·CVSS 6.5 EPSS 0.31%

   Unauthenticated Broken Access Control in WooCommerce Anti-Fraud <= 7.2.6 versions.

2. CVE-2026-49071 WordPress WooCommerce Dropshipping plugin <= 5.2.4 - Broken Authentication vulnerability

   Published 2026-06-17

   Medium·CVSS 6.5 EPSS 0.31%

   Unauthenticated Broken Authentication in WooCommerce Dropshipping <= 5.2.4 versions.

3. CVE-2024-35748 WordPress WooCommerce Dropshipping plugin <= 5.0.4 - Unauthenticated Arbitrary Email Sending vulnerability

   Published 2024-06-09

   Medium·CVSS 5.3 EPSS 0.31%

   Missing Authorization vulnerability in OPMC WooCommerce Dropshipping.This issue affects WooCommerce Dropshipping: from n/a through 5.0.4.

4. CVE-2022-3481 WooCommerce Dropshipping < 4.4 - Unauthenticated SQLi

   Published 2022-11-07

   Critical·CVSS 9.8 EPSS 5.3%

   The WooCommerce Dropshipping WordPress plugin before 4.4 does not properly sanitise and escape a parameter before using it in a SQL statement via a REST endpoint available to unauthenticated users, leading to a SQL injection

Sources: CVE.org, NVD, CISA KEV, FIRST EPSS, OSV and public exploit-reference metadata. Product matching comes from the published CVE records. A proof-of-concept means public code exists; it is not evidence of exploitation.