ShopBoost <= 1.8.9 - Unauthenticated Missing Authorization to Product Photo Upload When Guest Uploads Are Disabled
- ID
- WPSEC-2026-3146
- Plugin
- ShopBoost – WooCommerce Toolkit (flexible-minimum-order)
- Affected
- from 1.8.7 before 1.9.0
- Remediation
- Update to 1.9.0 or later.
- CVSS 3.1
- CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N
- Weakness
- CWE-862
- Usage
- Plugin Low · Affected versions None seen among sites WPSec scans, 2026-11-14
- Attack surface
- ShopBoost on WPSec AttackSurface
- Fix released
- Published
Description
The ShopBoost plugin for WordPress is vulnerable to unauthorized access via the flexmior_photo_upload AJAX action in all versions up to, and including, 1.8.9. This is due to the 'allow guest photo uploads' setting being enforced only when the upload field is rendered, and not in the upload handler or when the photo is attached to the cart item. The handler's nonce is printed to guests on any product page that has the feature enabled. This makes it possible for unauthenticated attackers to upload image files and attach them to cart items even after the site owner has disabled guest uploads. Guest uploads are allowed by default.
References
- https://wpsec.com/vuln/WPSEC-2026-3146/
- https://plugins.svn.wordpress.org/flexible-minimum-order/tags/1.9.0/
- https://wordpress.org/plugins/flexible-minimum-order/
Published by WPSec. Provided as is, without warranty. Corrections: contact us.
This advisory as JSON or Markdown · All advisories: JSON, RSS