# Product Gallery Slider for WooCommerce <= 2.3.25 - Authenticated (Shop Manager+) Missing Authorization to Arbitrary Options Read, Update, and Deletion via Settings Backup AJAX Actions

- **ID:** WPSEC-2026-2261
- **Plugin:** Product Gallery Slider, Additional Variation Images for WooCommerce (`woo-product-gallery-slider`), https://wordpress.org/plugins/woo-product-gallery-slider/
- **Affected versions:** all versions before 2.3.26
- **Fixed in:** 2.3.26 (Update to 2.3.26 or later.)
- **Severity:** High 7.2 (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H)
- **Weakness:** CWE-862
- **Usage among sites WPSec scans:** plugin Low, affected versions Low (as of 2026-11-03)
- **Attack surface analysis:** https://attacksurface.wpsec.com/plugin/woo-product-gallery-slider
- **Fix released:** 2026-10-31
- **Published:** 2026-11-03
- **URL:** https://wpsec.com/vuln/WPSEC-2026-2261/

## Description

The Product Gallery Slider, Additional Variation Images for WooCommerce plugin for WordPress is vulnerable to unauthorized access, modification, and deletion of data via the settings backup export, import, and reset AJAX actions (csf-export, csf-import, csf-reset) in all versions up to, and including, 2.3.25. This is due to a missing capability check and missing validation of the option name in the 'unique' parameter. The plugin's settings page, which prints the backup nonce, is available to users with the manage_woocommerce capability. This makes it possible for authenticated attackers, with Shop Manager-level access and above, to read any WordPress option, delete any option, or overwrite any option with array data. Overwriting the user roles option lets them escalate their privileges to administrator.

## References

- https://wpsec.com/vuln/WPSEC-2026-2261/
- https://plugins.svn.wordpress.org/woo-product-gallery-slider/tags/2.3.26/
- https://wordpress.org/plugins/woo-product-gallery-slider/

Source: WPSec, https://wpsec.com/vuln/WPSEC-2026-2261/

License: CC BY 4.0 (https://creativecommons.org/licenses/by/4.0/). Free to use, share and adapt, also commercially, if you credit WPSec and link to this advisory.