VillaTheme Salevo CVE-2026-103080

Exploitation requires that the target WordPress site has the VillaTheme Salevo (woo-boost-sales) plugin installed and active at a version at or below 1.3.0, with the affected request-handling endpoint reachable over the network. Per the CVSS vector (AV:N/AC:L/PR:N/UI:N) no authentication, no user interaction, and no special non-default configuration are indicated, so default installations appear exploitable by remote attackers. The practical LIMITING factors are: the flaw yields only a partial integrity impact (I:L, with C:N/A:N), so there is no direct data disclosure or denial of service; the attacker must know or discover the specific immutable parameter accepted by the plugin; and the site must actually run this specific plugin, whose deployment footprint is limited.

This is a moderate-severity (CVSS 5.3) issue that is unlikely to be a top patching priority despite its unauthenticated network vector. The CVSS vector (AV:N/AC:L/PR:N/UI:N) describes remote, low-complexity, unauthenticated reachability, but the impact is deliberately constrained to a partial integrity effect only (C:N/I:L/A:N), consistent with CWE-472 (External Control of Assumed-Immutable Web Parameter) - an attacker can tamper with a parameter the application assumes is fixed, without directly reading data or affecting availability. No EPSS score, CISA KEV listing, or public POC is present in the provided data, so there is no evidence of active exploitation or weaponization; this reads as a real but low-urgency flaw rather than a high-impact one. CONFLICT TO NOTE: the input Tags label this 'Information Disclosure,' which implies a confidentiality impact, yet the CVSS vector sets C:N and scores only integrity (I:L); the Patchstack reference title instead calls it a 'broken access control' issue. These three framings do not fully agree - verify with Patchstack/vendor whether any data disclosure actually occurs, as the authoritative CVSS vector indicates integrity tampering only.

A remote, unauthenticated attacker sends a crafted HTTP request to a WordPress site running the Salevo (woo-boost-sales) plugin, supplying a value for a web parameter the plugin assumes cannot be altered by the client. Because low attack complexity and no authentication are required, the attacker manipulates the application's logic or stored state to produce an outcome the operator did not intend. No public exploit code is identified at time of analysis.