Vulnerabilities / CoDesigner WooCommerce Builder for Elementor / WPSEC-2026-1328
CoDesigner WooCommerce Builder for Elementor <= 4.41 - Missing Authorization to Unauthenticated Limited Plugin Installation via Setup Wizard
Medium 5.3
CWE-862Fixed in 4.42
- ID
- WPSEC-2026-1328
- Plugin
- CoDesigner – All in One Elementor WooCommerce Builder (woolementor)
- Affected
- all versions before 4.42
- Remediation
- Update to 4.42 or later.
- CVSS 3.1
- CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
- Weakness
- CWE-862
- Usage
- Plugin Low · Affected versions Low among sites WPSec scans, 2026-10-21
- Attack surface
- CoDesigner WooCommerce Builder for Elementor on WPSec AttackSurface
- Fix released
- Published
Description
The CoDesigner plugin for WordPress is vulnerable to unauthorized plugin installation via the setup wizard's install_plugins function in all versions up to, and including, 4.41. This is due to a missing capability check and missing nonce validation. The wizard's save handler runs on the wp_loaded hook for every request, whether or not the visitor is logged in. This makes it possible for unauthenticated attackers to schedule the installation and activation of the EasyCommerce plugin from WordPress.org. The plugin slug is fixed.
References
- https://wpsec.com/vuln/WPSEC-2026-1328/
- https://plugins.svn.wordpress.org/woolementor/tags/4.42/
- https://wordpress.org/plugins/woolementor/
Published by WPSec. Provided as is, without warranty. Corrections: contact us.
This advisory as JSON or Markdown · All advisories: JSON, RSS