VillaTheme HANDMADE: Missing Authorization vulnerability (CVE-2026-112827)
VillaTheme HANDMADE - Dropshipping for Etsy and WooCommerce up to version 1.0.10 contains a missing authorization vulnerability that allows unauthorized users to perform restricted actions or manipulate plugin settings.
CVE search metadata
CVE search record: CVE-2026-112827. Severity: high. CVSS: 7.1. KEV: no. Product: HANDMADE – Dropshipping for Etsy and WooCommerce (<= 1.0.10). Brief: VillaTheme HANDMADE: Missing Authorization vulnerability (CVE-2026-112827). Brief link: https://feed.craftedsignal.io/briefs/2026-10-villatheme-handmade-auth/
Triage facts
Revision 1- Applicability
- HANDMADE – Dropshipping for Etsy and WooCommerce (<= 1.0.10)
- Evidence
- Unknown
- Severity
- Medium
- Action
- Elevated
- Sources
- 1 public source
- Freshness
- Revision 1Oct 29, 15:39 UTC
- Vulnerabilities
- 1 CVE
- Source quality
- A5Likely
The HANDMADE - Dropshipping for Etsy and WooCommerce plugin is affected by a missing authorization vulnerability (CVE-2026-112827). This flaw exists due to incorrectly configured access control security levels, which allows unauthorized users to bypass permission checks and perform administrative actions or manipulate plugin configurations. The vulnerability impacts all versions from inception through 1.0.10. At this time, no patch version is specified.
Impact
Successful exploitation may allow an unauthorized attacker to gain elevated privileges or manipulate sensitive plugin data, potentially impacting the integrity and confidentiality of the WooCommerce store's dropshipping operations.
Recommendation
- Inventory all WordPress instances running the 'HANDMADE - Dropshipping for Etsy and WooCommerce' plugin.
- Monitor WordPress administrative access logs for unauthorized access to plugin configuration pages or unexpected administrative API calls originating from non-administrative users.
- Disable the plugin if it is not business-critical until a vendor patch is released.
- Review the VillaTheme official changelog and advisory portal regularly for the release of version 1.0.11 or later.
Immediate actions
Inventory all sites running HANDMADE plugin and restrict access until patch is available
Threat Hunt
Identify unauthorized access to plugin configuration endpoints by non-administrator users
Data: WordPress access logs, Admin interface request logs
Mitigations
Disable the HANDMADE plugin until a secure update is released
CVE-2026-112827