What is the CVSS score of CVE-2026-15411?

CVE-2026-15411 has a CVSS 3.1 base score of 5.3 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N. EPSS exploitation probability: 0.3%.

StoreGrowth CVE-2026-15411

EUVD-2026-49763 MEDIUM

Missing Authorization (CWE-862)

2026-07-28 Wordfence

GHSA-xrhw-gwf7-m34v

WordPress Authentication Bypass Wordpress Plugin Storegrowth Upsell Bogo Quick View Direct Checkout Side Cart For Woocommerce Wedevs

5.3

CVSS 3.1 · Vendor: Wordfence

Severity by source

Vendor (Wordfence) PRIMARY

5.3 MEDIUM

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N

vuln.today AI

5.3 MEDIUM

Unauthenticated network access, low complexity, no special conditions; only low integrity impact.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (Wordfence).

CVSS VectorVendor: Wordfence

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

Low

Availability

None

Lifecycle Timeline

Analysis Generated

Jul 28, 2026 - 12:17 vuln.today

CVE Published

Jul 28, 2026 - 11:32 cve.org

MEDIUM 5.3

DescriptionCVE.org

The StoreGrowth: Smart Sales Booster for WooCommerce | BOGO, Upsells, Direct Checkout, Quick View, Side Cart plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 2.1.0. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for unauthenticated attackers to overwrite the spsg_popup_products option with arbitrary attacker-controlled data. The 'ajd_protected' nonce used as the sole gate is exposed to unauthenticated visitors on every frontend page through the BoGo module's wp_localize_script call, rendering it ineffective as an authorization barrier.

AnalysisAI

Authorization bypass in StoreGrowth for WooCommerce allows unauthenticated attackers to overwrite the spsg_popup_products option with arbitrary data. The plugin fails to properly verify user authorization, relying on a nonce that is publicly exposed to all visitors via wp_localize_script in the BoGo module. Affects all versions up to 2.1.0; no active exploitation or public exploit code identified at time of analysis.

Technical ContextAI

The vulnerability is an instance of CWE-862: Missing Authorization. The plugin's Ajax endpoint (in modules/sales-pop/includes/Ajax.php) processes a request to update the spsg_popup_products option without proper permission checks. The only gate is the 'ajd_protected' nonce, which is intentionally exposed to unauthenticated users via the BoGo module's EnqueueScript.php (line 170) on every frontend page. This defeats the purpose of a nonce, as an attacker can simply read the current nonce value from the page source and include it in a forged AJAX request. The CPE cpe:2.3:a:wedevs:storegrowth_-_upsell,_bogo,_quick_view,_direct_checkout_&_side_cart_for_woocommerce covers all versions up to 2.1.0.

RemediationAI

Apply the patch from the changeset reference: https://plugins.trac.wordpress.org/changeset?reponame=&old=3619581%40storegrowth-sales-booster&new=3619581%40storegrowth-sales-booster. At the time of analysis, no tagged release with the fix has been confirmed; check the WordPress plugin repository for an updated version. As a workaround, disable the plugin entirely or deactivate the BoGo module if not needed, but note that the vulnerable Ajax endpoint is in the sales-pop module, so partial disabling may not fully mitigate the risk. Ensure that any user-supplied data stored in the spsg_popup_products option is sanitized before output to prevent secondary injection attacks.