{
 "id": "WPSEC-2026-2261",
 "url": "https://wpsec.com/vuln/WPSEC-2026-2261/",
 "json_url": "https://wpsec.com/vuln/WPSEC-2026-2261/advisory.json",
 "markdown_url": "https://wpsec.com/vuln/WPSEC-2026-2261/index.md",
 "title": "Product Gallery Slider for WooCommerce <= 2.3.25 - Authenticated (Shop Manager+) Missing Authorization to Arbitrary Options Read, Update, and Deletion via Settings Backup AJAX Actions",
 "description": "The Product Gallery Slider, Additional Variation Images for WooCommerce plugin for WordPress is vulnerable to unauthorized access, modification, and deletion of data via the settings backup export, import, and reset AJAX actions (csf-export, csf-import, csf-reset) in all versions up to, and including, 2.3.25. This is due to a missing capability check and missing validation of the option name in the 'unique' parameter. The plugin's settings page, which prints the backup nonce, is available to users with the manage_woocommerce capability. This makes it possible for authenticated attackers, with Shop Manager-level access and above, to read any WordPress option, delete any option, or overwrite any option with array data. Overwriting the user roles option lets them escalate their privileges to administrator.",
 "plugin": {
  "slug": "woo-product-gallery-slider",
  "name": "Product Gallery Slider for WooCommerce",
  "full_name": "Product Gallery Slider, Additional Variation Images for WooCommerce",
  "wordpress_org": "https://wordpress.org/plugins/woo-product-gallery-slider/",
  "advisories_url": "https://wpsec.com/vuln/plugin/woo-product-gallery-slider/",
  "attacksurface": "https://attacksurface.wpsec.com/plugin/woo-product-gallery-slider"
 },
 "type": "NO AUTHORISATION",
 "cwe": [
  "CWE-862"
 ],
 "cve": [],
 "cvss": {
  "version": "3.1",
  "score": 7.2,
  "vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H",
  "severity": "High"
 },
 "affected": {
  "ranges": [
   {
    "from": null,
    "from_inclusive": true,
    "to": "2.3.26",
    "to_inclusive": false
   }
  ],
  "text": [
   "all versions before 2.3.26"
  ]
 },
 "introduced_in": null,
 "fixed_in": "2.3.26",
 "remediation": "Update to 2.3.26 or later.",
 "fix_released": "2026-10-31T15:18:43+00:00",
 "published": "2026-11-03T14:48:33+00:00",
 "updated": "2026-11-03T13:21:58.072759+00:00",
 "also_published_as": null,
 "references": [
  "https://wpsec.com/vuln/WPSEC-2026-2261/",
  "https://plugins.svn.wordpress.org/woo-product-gallery-slider/tags/2.3.26/",
  "https://wordpress.org/plugins/woo-product-gallery-slider/"
 ],
 "attacksurface_url": "https://attacksurface.wpsec.com/plugin/woo-product-gallery-slider",
 "source": "WPSec",
 "license": {
  "name": "CC BY 4.0",
  "url": "https://creativecommons.org/licenses/by/4.0/"
 },
 "usage": {
  "plugin": "Low",
  "affected_versions": "Low",
  "as_of": "2026-11-03"
 }
}