{
 "id": "WPSEC-2026-1328",
 "url": "https://wpsec.com/vuln/WPSEC-2026-1328/",
 "json_url": "https://wpsec.com/vuln/WPSEC-2026-1328/advisory.json",
 "markdown_url": "https://wpsec.com/vuln/WPSEC-2026-1328/index.md",
 "title": "CoDesigner WooCommerce Builder for Elementor <= 4.41 - Missing Authorization to Unauthenticated Limited Plugin Installation via Setup Wizard",
 "description": "The CoDesigner plugin for WordPress is vulnerable to unauthorized plugin installation via the setup wizard's install_plugins function in all versions up to, and including, 4.41. This is due to a missing capability check and missing nonce validation. The wizard's save handler runs on the wp_loaded hook for every request, whether or not the visitor is logged in. This makes it possible for unauthenticated attackers to schedule the installation and activation of the EasyCommerce plugin from WordPress.org. The plugin slug is fixed.",
 "plugin": {
  "slug": "woolementor",
  "name": "CoDesigner WooCommerce Builder for Elementor",
  "full_name": "CoDesigner – All in One Elementor WooCommerce Builder",
  "wordpress_org": "https://wordpress.org/plugins/woolementor/",
  "advisories_url": "https://wpsec.com/vuln/plugin/woolementor/",
  "attacksurface": "https://attacksurface.wpsec.com/plugin/woolementor"
 },
 "type": "NO AUTHORISATION",
 "cwe": [
  "CWE-862"
 ],
 "cve": [],
 "cvss": {
  "version": "3.1",
  "score": 5.3,
  "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N",
  "severity": "Medium"
 },
 "affected": {
  "ranges": [
   {
    "from": null,
    "from_inclusive": true,
    "to": "4.42",
    "to_inclusive": false
   }
  ],
  "text": [
   "all versions before 4.42"
  ]
 },
 "introduced_in": null,
 "fixed_in": "4.42",
 "remediation": "Update to 4.42 or later.",
 "fix_released": "2026-10-20T10:59:49+00:00",
 "published": "2026-10-21T11:49:28+00:00",
 "updated": "2026-10-21T10:34:39.710831+00:00",
 "also_published_as": null,
 "references": [
  "https://wpsec.com/vuln/WPSEC-2026-1328/",
  "https://plugins.svn.wordpress.org/woolementor/tags/4.42/",
  "https://wordpress.org/plugins/woolementor/"
 ],
 "attacksurface_url": "https://attacksurface.wpsec.com/plugin/woolementor",
 "source": "WPSec",
 "license": {
  "name": "CC BY 4.0",
  "url": "https://creativecommons.org/licenses/by/4.0/"
 },
 "usage": {
  "plugin": "Low",
  "affected_versions": "Low",
  "as_of": "2026-10-21"
 }
}