Product Gallery Slider for WooCommerce <= 2.3.25 - Authenticated (Shop Manager+) Missing Authorization to Arbitrary Options Read, Update, and Deletion via Settings Backup AJAX Actions
- ID
- WPSEC-2026-2261
- Plugin
- Product Gallery Slider, Additional Variation Images for WooCommerce (woo-product-gallery-slider)
- Affected
- all versions before 2.3.26
- Remediation
- Update to 2.3.26 or later.
- CVSS 3.1
- CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
- Weakness
- CWE-862
- Usage
- Plugin Low · Affected versions Low among sites WPSec scans, 2026-11-03
- Attack surface
- Product Gallery Slider for WooCommerce on WPSec AttackSurface
- Fix released
- Published
Description
The Product Gallery Slider, Additional Variation Images for WooCommerce plugin for WordPress is vulnerable to unauthorized access, modification, and deletion of data via the settings backup export, import, and reset AJAX actions (csf-export, csf-import, csf-reset) in all versions up to, and including, 2.3.25. This is due to a missing capability check and missing validation of the option name in the 'unique' parameter. The plugin's settings page, which prints the backup nonce, is available to users with the manage_woocommerce capability. This makes it possible for authenticated attackers, with Shop Manager-level access and above, to read any WordPress option, delete any option, or overwrite any option with array data. Overwriting the user roles option lets them escalate their privileges to administrator.
References
- https://wpsec.com/vuln/WPSEC-2026-2261/
- https://plugins.svn.wordpress.org/woo-product-gallery-slider/tags/2.3.26/
- https://wordpress.org/plugins/woo-product-gallery-slider/
Published by WPSec. Provided as is, without warranty. Corrections: contact us.
This advisory as JSON or Markdown · All advisories: JSON, RSS