Product Gallery Slider CVE-2026-120318

Requires an authenticated WordPress account with the Shop Manager role (or higher) on a store running Product Gallery Slider & Additional Variation Images for WooCommerce 2.3.23 before 2.3.26; the attacker must be able to view the plugin settings page to harvest the csf_backup_nonce, then invoke the csf-export, csf-import or csf-reset Codestar AJAX actions with an attacker-chosen 'unique' option name. Exploitation is LIMITED by this pre-existing privilege: it is not reachable by anonymous visitors, subscribers or customers, so practical risk concentrates on multi-role stores that delegate the Shop Manager role to semi-trusted staff; single-administrator sites with no additional privileged accounts have little realistic exposure. No special non-default configuration is required beyond having the vulnerable plugin version active.

This is a real but gated privilege-escalation issue rather than a remote unauthenticated catastrophe. The supplied CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:H/UI:N, VC:H/VI:H/VA:H) scores 8.6 and correctly reflects that exploitation requires an existing high-privilege account: per the description the actor is a Shop Manager who can already view the settings page. CWE-862 (missing authorization) matches the mechanism - the Codestar backup AJAX actions (csf-export, csf-import, csf-reset) do not verify the caller's capability, so a Shop Manager can read/overwrite/delete arbitrary WordPress options and rewrite wp_user_roles to become administrator, a full integrity and availability compromise of the site. Signals are mixed in a way that lowers urgency versus the headline score: there is NO CISA KEV listing, NO EPSS score provided in the input, and NO confirmed working proof-of-concept - the references are the VulnCheck advisory and the patched/unpatched plugin source files, not exploit code. The vuln.today decision label is 'this_week', consistent with a serious-but-not-emergency flaw requiring a privileged foothold. Bottom line: prioritize patching on multi-author/multi-role WooCommerce stores where non-administrator staff accounts exist, because the PR:H barrier is low in practice there (Shop Manager is a common delegated role); on single-admin stores the practical exposure is minimal since the only accounts able to trigger it are already trusted.

An attacker who controls or has compromised a WordPress Shop Manager account on a store running the plugin (2.3.23 up to but not including 2.3.26) opens the plugin settings page, reads the exposed csf_backup_nonce, and calls the csf-import AJAX action supplying 'unique' = wp_user_roles with a payload that grants their user the administrator role. No separate admin action or user interaction is needed. No confirmed public exploit code is identified at time of analysis; only the VulnCheck advisory and plugin source references exist.