Live › vulnerability › CVE-2026-120318
Product Gallery Slider for WooCommerce has a missing authorization check in its backup AJAX actions, so a Shop Manager account can read, overwrite or delete any WordPress option. An attacker can edit wp_user_roles and grant themselves the administrator role.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-11-02 15:24 UTC. All times on this page are UTC.
Sites running the WooCommerce gallery plugin at versions 2.3.23 through 2.3.25 where Shop Manager accounts exist. The flaw is in the plugin's backup AJAX handlers, which accept requests from any logged-in user with shop manager rights, so sites without Shop Manager users are not exposed through this path. Teams that have already upgraded to 2.3.26 or later can skip it.
No product ranges from the sources yet.
Unknown from the sources.
2.3.26 or later.Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
Product Gallery Slider & Additional Variation Images for WooCommerce 2.3.23 before 2.3.26 contains a missing authorization vulnerability in Codestar backup AJAX actions csf-export, csf-import and csf-reset. Shop Managers can read the csf_backup_nonce from the settings page and supply arbitrary option names via the 'unique' parameter to read, overwrite or delete WordPress options, including modifying wp_user_roles to escalate to administrator.
This page as .md · .json · in your agent: get_signal("CVE-2026-120318")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.