{"description":"Trending threats, MITRE ATT\u0026CK coverage, and detection metadata. Fed continuously.","favicon":"https://feed.craftedsignal.io/favicon-32x32.png","feed_url":"https://feed.craftedsignal.io/vendors/villatheme/feed.json","home_page_url":"https://feed.craftedsignal.io/","icon":"https://feed.craftedsignal.io/apple-touch-icon.png","items":[{"_cs_actors":[],"_cs_cpes":["cpe:2.3:a:villatheme:handmade_-_dropshipping_for_etsy_and_woocommerce:*:*:*:*:*:wordpress:*:*"],"_cs_cves":[{"cvss":7.1,"id":"CVE-2026-112827"}],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["HANDMADE – Dropshipping for Etsy and WooCommerce (\u003c= 1.0.10)"],"_cs_severities":["medium"],"_cs_tags":[],"_cs_type":"advisory","_cs_vendors":["VillaTheme"],"content_html":"\u003cp\u003eThe HANDMADE - Dropshipping for Etsy and WooCommerce plugin is affected by a missing authorization vulnerability (CVE-2026-112827). This flaw exists due to incorrectly configured access control security levels, which allows unauthorized users to bypass permission checks and perform administrative actions or manipulate plugin configurations. The vulnerability impacts all versions from inception through 1.0.10. At this time, no patch version is specified.\u003c/p\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eSuccessful exploitation may allow an unauthorized attacker to gain elevated privileges or manipulate sensitive plugin data, potentially impacting the integrity and confidentiality of the WooCommerce store's dropshipping operations.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eInventory all WordPress instances running the 'HANDMADE - Dropshipping for Etsy and WooCommerce' plugin.\u003c/li\u003e\n\u003cli\u003eMonitor WordPress administrative access logs for unauthorized access to plugin configuration pages or unexpected administrative API calls originating from non-administrative users.\u003c/li\u003e\n\u003cli\u003eDisable the plugin if it is not business-critical until a vendor patch is released.\u003c/li\u003e\n\u003cli\u003eReview the VillaTheme official changelog and advisory portal regularly for the release of version 1.0.11 or later.\u003c/li\u003e\n\u003c/ul\u003e\n","date_modified":"2026-10-29T15:39:55Z","date_published":"2026-10-29T15:39:55Z","id":"https://feed.craftedsignal.io/briefs/2026-10-villatheme-handmade-auth/","summary":"VillaTheme HANDMADE - Dropshipping for Etsy and WooCommerce up to version 1.0.10 contains a missing authorization vulnerability that allows unauthorized users to perform restricted actions or manipulate plugin settings.","title":"VillaTheme HANDMADE: Missing Authorization vulnerability (CVE-2026-112827)","url":"https://feed.craftedsignal.io/briefs/2026-10-villatheme-handmade-auth/"}],"language":"en","title":"CraftedSignal Threat Feed - VillaTheme","version":"https://jsonfeed.org/version/1.1"}