Product Gallery Slider for WooCommerce 2.3.23 before 2.3.26 Missing Authorization via Codestar AJAX
Product Gallery Slider for WooCommerce versions 2.3.23 through 2.3.25 are affected via Codestar-derived backup AJAX handlers that lack authorization checks. CVSS rates it High (8.6); no vendor rating is given. Fixed in 2.3.26.
Written by anthropic/claude-haiku-5.5 from the sources below. Verify against them.
- Exploited
- No known exploitation
- Fix
- Fixed in 2.3.26
- Who is exposed
- Specific setups only
Do first: Check whether your setup matches what the bug needs. The plugin includes the Codestar-derived backup AJAX handlers (csf-export, csf-import, csf-reset). The plugin settings page is available to users with the manage_woocommerce capability.
- Last modified
- Where the record stands: published, rejected by its publisher, or superseded by another id.What do these mean? →
- Published
- Whether CISA lists it in its Known Exploited Vulnerabilities catalog: proof that attackers are using it.What do these mean? →
- Not listed in CISA KEV
- A 0-100 score for how much a CVE matters across the industry: exploitation, exposure, how widely the software is used, severity and whether a fix exists.What do these mean? →
- 18/100 · provisional
- How many real-world setups can hit the bug, from the vendor's advisory and CISA data. It does not know your setup.What do these mean? →
- Specific setups only
- Fix
- Fixed in 2.3.26
- Whether working attack code is public (Exploit-DB, Metasploit, Nuclei or GitHub). Public code makes attacks easier.What do these mean? →
- None on Exploit-DB, Metasploit or GitHub
- Exploitation: none
- Automatable: no
- Technical impact: total
Summary
The Product Gallery Slider & Additional Variation Images plugin for WooCommerce, used on WordPress sites, is affected by a flaw that lets users with the Shop Manager role read, change, or delete arbitrary WordPress settings. This could allow such a user to grant themselves administrator privileges, giving them full control over the website.
Read the original description
Product Gallery Slider & Additional Variation Images for WooCommerce 2.3.23 before 2.3.26 contains a missing authorization vulnerability in Codestar backup AJAX actions csf-export, csf-import and csf-reset. Shop Managers can read the csf_backup_nonce from the settings page and supply arbitrary option names via the 'unique' parameter to read, overwrite or delete WordPress options, including modifying wp_user_roles to escalate to administrator.
What to do
Check whether your setup matches what the bug needs.
The plugin includes the Codestar-derived backup AJAX handlers (csf-export, csf-import, csf-reset). The plugin settings page is available to users with the manage_woocommerce capability.Upgrade to a fixed version: 2.3.26.
Timeline
- CVE published
- First seen by cve.now
- CISA SSVC assessment
Exploitation: none · Automatable: no · Technical impact: total
- Record last updated
Affected versions
- Codeixer Product Gallery Slider & Additional Variation Images for WooCommerce
From 2.3.23 · fixed in 2.3.26
Evidence 6
- Patch
- Patch
- Link
- Link
- Link
- Link
Corrections
None so far.
Something wrong on this page? Report an error. Every fix is listed here.
Questions about CVE-2026-120318
What does this mean?
The plugin's Codestar-derived backup AJAX handlers (csf-export, csf-import, csf-reset) do not check authorization properly. A user without the right permission can read, overwrite or delete WordPress options, including wp_user_roles, which can be used to gain administrator privileges.Source: plugins.svn.wordpress.org, plugins.svn.wordpress.org
Am I affected, and how do I check?
Versions 2.3.23 up to, but not including, 2.3.26 of Product Gallery Slider & Additional Variation Images for WooCommerce by Codeixer are in the affected range. The settings page is limited to users with the manage_woocommerce capability, and the handlers are present in the plugin code; check the installed version in the plugin list or the Plugins screen in WordPress admin.Source: plugins.svn.wordpress.org, plugins.svn.wordpress.org
What should I do about it?
Upgrade the plugin to version 2.3.26 or later, which is the fixed release.Source: plugins.svn.wordpress.org, plugins.svn.wordpress.org
Is it being exploited?
It is not in CISA's Known Exploited Vulnerabilities catalog, and CISA's SSVC assessment does not mark exploitation as active. That does not mean it has not been attacked: vendors and researchers can report attacks before CISA lists them. No public exploit code is tracked.Source: cve.now feed data