{"id":"CVE-2026-120318","kind":"vulnerability","aliases":["CVE-2026-120318"],"related":[],"title":"WooCommerce gallery plugin lets shop managers take over the site","description":"Product Gallery Slider & Additional Variation Images for WooCommerce 2.3.23 before 2.3.26 contains a missing authorization vulnerability in Codestar backup AJAX actions csf-export, csf-import and csf-reset. Shop Managers can read the csf_backup_nonce from the settings page and supply arbitrary option names via the 'unique' parameter to read, overwrite or delete WordPress options, including modifying wp_user_roles to escalate to administrator.","summary":"Product Gallery Slider for WooCommerce has a missing authorization check in its backup AJAX actions, so a Shop Manager account can read, overwrite or delete any WordPress option. An attacker can edit wp_user_roles and grant themselves the administrator role.","severity":"high","cvss":8.6,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["package","self-hosted","woocommerce","wordpress"],"not_affected_if":["no-shop-manager-users","plugin-version-2.3.26-or-later"],"how_to_check":null,"fix":"- Update the plugin to `2.3.26` or later.","status":"open","published_at":"2026-11-02T15:17:22+00:00","first_seen_at":"2026-11-02T15:24:01+00:00","triaged_at":"2026-11-02T15:25:53+00:00","updated_at":"2026-11-02T15:25:53+00:00","category":"package","confidence":0.7,"triage":{"at":"2026-11-02T15:25:53Z","model":"claude-haiku-5-5","output":{"fix":"- Update the plugin to `2.3.26` or later.","reach":"internet","title":"WooCommerce gallery plugin lets shop managers take over the site","impact":"high","summary":"Product Gallery Slider for WooCommerce has a missing authorization check in its backup AJAX actions, so a Shop Manager account can read, overwrite or delete any WordPress option. An attacker can edit wp_user_roles and grant themselves the administrator role.","audience":"businesses","category":"package","nicknames":[],"who_cares":["wordpress","woocommerce","self-hosted"],"confidence":0.7,"fix_status":"available","needs_auth":"yes","worst_case":"Attacker becomes site administrator and controls the WordPress install","analyst_note":"","how_to_check":"- Look for the plugin `Product Gallery Slider & Additional Variation Images for WooCommerce` in the WordPress plugins list and note its version.\n- Check whether the installed version is `2.3.23` to `2.3.25`.\n- Check whether any users hold the Shop Manager role who should not.","plain_action":"","needs_analyst":false,"not_affected_if":["plugin-version-2.3.26-or-later","no-shop-manager-users"],"who_is_affected":"Sites running the WooCommerce gallery plugin at versions 2.3.23 through 2.3.25 where Shop Manager accounts exist. The flaw is in the plugin's backup AJAX handlers, which accept requests from any logged-in user with shop manager rights, so sites without Shop Manager users are not exposed through this path. Teams that have already upgraded to 2.3.26 or later can skip it.","user_interaction":"no","needs_special_setup":"no","severity_if_unknown":"high"},"cost_usd":0.000723,"input_tokens":4215,"output_tokens":603,"severity_before":"high"},"analyst_status":null,"analyst_note":null,"search":"'-120318':13A,16A '-2026':12A,15A '2.3.23':72C '2.3.26':74C 'account':42B 'action':37B,84C 'addit':67C 'administr':62B,131C 'ajax':36B,83C 'arbitrari':109C 'attack':52B 'author':31B,78C 'backup':35B,82C,101C 'check':32B 'codestar':81C 'contain':75C 'csf':86C,89C,93C,100C 'csf-export':85C 'csf-import':88C 'csf-reset':92C 'cve':11A,14A 'delet':47B,120C 'edit':54B 'escal':129C 'export':87C 'galleri':2A,24B,65C 'grant':59B 'host':20B 'imag':69C 'import':90C 'includ':123C 'let':4A 'manag':6A,41B,96C 'miss':30B,77C 'modifi':124C 'name':111C 'nonc':102C 'option':50B,110C,122C 'overwrit':45B,118C 'packag':17B 'page':106C 'paramet':115C 'plugin':3A 'product':23B,64C 'read':44B,98C,117C 'reset':94C 'role':57B,63B,127C 'self':19B 'self-host':18B 'set':105C 'shop':5A,40B,95C 'site':10A 'slider':25B,66C 'suppli':108C 'take':7A 'uniqu':114C 'user':56B,126C 'variat':68C 'via':112C 'vulner':79C 'woocommerc':1A,21B,27B,71C 'wordpress':22B,49B,121C 'wp':55B,125C","nicknames":[],"mitigations":[],"who_affected":"Sites running the WooCommerce gallery plugin at versions 2.3.23 through 2.3.25 where Shop Manager accounts exist. The flaw is in the plugin's backup AJAX handlers, which accept requests from any logged-in user with shop manager rights, so sites without Shop Manager users are not exposed through this path. Teams that have already upgraded to 2.3.26 or later can skip it.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["high","package","selfhosted","woocommerce","wordpress"],"first_public_at":"2026-11-02T15:17:22+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"disclosure@vulncheck.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-120318","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-120318","severity":null,"published_at":"2026-11-02T15:17:22+00:00","modified_at":"2026-11-02T15:17:22+00:00","first_seen_at":"2026-11-02T15:24:01+00:00","fetched_at":"2026-11-02T15:24:01+00:00","note":null}],"documents":[{"id":52437,"url":"https://www.vulncheck.com/advisories/product-gallery-slider-for-woocommerce-2.3.23-before-2.3.26-missing-authorization-via-codestar-ajax","title":"Third-party advisory: www.vulncheck.com","kind":"advisory","source":"nvd","publisher":"research","text":null,"published_at":null,"relation":"advisory","confidence":null,"note":"Third-party advisory: www.vulncheck.com"}],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}