# CoDesigner WooCommerce Builder for Elementor <= 4.41 - Missing Authorization to Unauthenticated Limited Plugin Installation via Setup Wizard

- **ID:** WPSEC-2026-1328
- **Plugin:** CoDesigner – All in One Elementor WooCommerce Builder (`woolementor`), https://wordpress.org/plugins/woolementor/
- **Affected versions:** all versions before 4.42
- **Fixed in:** 4.42 (Update to 4.42 or later.)
- **Severity:** Medium 5.3 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N)
- **Weakness:** CWE-862
- **Usage among sites WPSec scans:** plugin Low, affected versions Low (as of 2026-10-21)
- **Attack surface analysis:** https://attacksurface.wpsec.com/plugin/woolementor
- **Fix released:** 2026-10-20
- **Published:** 2026-10-21
- **URL:** https://wpsec.com/vuln/WPSEC-2026-1328/

## Description

The CoDesigner plugin for WordPress is vulnerable to unauthorized plugin installation via the setup wizard's install_plugins function in all versions up to, and including, 4.41. This is due to a missing capability check and missing nonce validation. The wizard's save handler runs on the wp_loaded hook for every request, whether or not the visitor is logged in. This makes it possible for unauthenticated attackers to schedule the installation and activation of the EasyCommerce plugin from WordPress.org. The plugin slug is fixed.

## References

- https://wpsec.com/vuln/WPSEC-2026-1328/
- https://plugins.svn.wordpress.org/woolementor/tags/4.42/
- https://wordpress.org/plugins/woolementor/

Source: WPSec, https://wpsec.com/vuln/WPSEC-2026-1328/

License: CC BY 4.0 (https://creativecommons.org/licenses/by/4.0/). Free to use, share and adapt, also commercially, if you credit WPSec and link to this advisory.