{
 "id": "WPSEC-2026-3146",
 "url": "https://wpsec.com/vuln/WPSEC-2026-3146/",
 "json_url": "https://wpsec.com/vuln/WPSEC-2026-3146/advisory.json",
 "markdown_url": "https://wpsec.com/vuln/WPSEC-2026-3146/index.md",
 "title": "ShopBoost <= 1.8.9 - Unauthenticated Missing Authorization to Product Photo Upload When Guest Uploads Are Disabled",
 "description": "The ShopBoost plugin for WordPress is vulnerable to unauthorized access via the flexmior_photo_upload AJAX action in all versions up to, and including, 1.8.9. This is due to the 'allow guest photo uploads' setting being enforced only when the upload field is rendered, and not in the upload handler or when the photo is attached to the cart item. The handler's nonce is printed to guests on any product page that has the feature enabled. This makes it possible for unauthenticated attackers to upload image files and attach them to cart items even after the site owner has disabled guest uploads. Guest uploads are allowed by default.",
 "plugin": {
  "slug": "flexible-minimum-order",
  "name": "ShopBoost",
  "full_name": "ShopBoost – WooCommerce Toolkit",
  "wordpress_org": "https://wordpress.org/plugins/flexible-minimum-order/",
  "advisories_url": "https://wpsec.com/vuln/plugin/flexible-minimum-order/",
  "attacksurface": "https://attacksurface.wpsec.com/plugin/flexible-minimum-order"
 },
 "type": "NO AUTHORISATION",
 "cwe": [
  "CWE-862"
 ],
 "cve": [],
 "cvss": {
  "version": "3.1",
  "score": 3.7,
  "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N",
  "severity": "Low"
 },
 "affected": {
  "ranges": [
   {
    "from": "1.8.7",
    "from_inclusive": true,
    "to": "1.9.0",
    "to_inclusive": false
   }
  ],
  "text": [
   "from 1.8.7 before 1.9.0"
  ]
 },
 "introduced_in": "1.8.7",
 "fixed_in": "1.9.0",
 "remediation": "Update to 1.9.0 or later.",
 "fix_released": "2026-11-13T20:39:52+00:00",
 "published": "2026-11-14T20:42:02+00:00",
 "updated": "2026-11-14T16:17:24.244521+00:00",
 "also_published_as": null,
 "references": [
  "https://wpsec.com/vuln/WPSEC-2026-3146/",
  "https://plugins.svn.wordpress.org/flexible-minimum-order/tags/1.9.0/",
  "https://wordpress.org/plugins/flexible-minimum-order/"
 ],
 "attacksurface_url": "https://attacksurface.wpsec.com/plugin/flexible-minimum-order",
 "source": "WPSec",
 "license": {
  "name": "CC BY 4.0",
  "url": "https://creativecommons.org/licenses/by/4.0/"
 },
 "usage": {
  "plugin": "Low",
  "affected_versions": "None seen",
  "as_of": "2026-11-14"
 }
}