EUVD-2026-49763
GHSA-xrhw-gwf7-m34v
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessVisit frontend page
-
ExploitExtract nonce from JavaScript
-
ExecutionSend AJAX POST with crafted data
-
ImpactOverwrite spsg_popup_products option
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A01:2025 - Broken Access Control
ASVS 5.0
V8 - Authorization Authorization checks on every request
MITRE ATT&CK
1 technique across 1 tactic: Privilege Escalation The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | No special conditions beyond having the plugin installed with the BoGo module active (default configuration). The nonce 'ajd_protected' is exposed to unauthenticated visitors on every frontend page via wp_localize_script. The Ajax endpoint is publicly accessible and does not require authentication. The limiting factor is that the impact is limited to overwriting a single option, and no user interaction is required. |
| Impact | CVSS 5.3 (Medium) with AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N indicates easy exploitation with limited impact (only low integrity). EPSS probability and KEV status are not provided in the available data, so risk is assessed solely on the vector. The attack is straightforward and requires no authentication or user interaction, but the only direct impact is overwriting a single option. However, because the attacker can inject arbitrary data into that option, potential secondary impacts (e.g., stored XSS if the option is rendered unsafely) are not captured by the vector. Overall, it is a moderate priority that should be patched promptly but likely not actively exploited at scale. |
| Exploit ScenarioDerived | An unauthenticated attacker visits any page on the WordPress site that includes the BoGo module's JavaScript (default behavior). The attacker extracts the 'ajd_protected' nonce from the JavaScript object. They then craft an HTTP POST request to the plugin's Ajax handler with the nonce and arbitrary data to overwrite the spsg_popup_products option. This could be used to inject malicious content if the option is later displayed without sanitization. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Jul 28, 2026
Authorization bypass in StoreGrowth for WooCommerce allows unauthenticated attackers to overwrite the spsg_popup_products option with arbitrary data. The plugin fails to properly verify user authorization, relying on a nonce that is publicly exposed to all visitors via wp_localize_script in the BoGo module. Affects all versions up to 2.1.0; no active exploitation or public exploit code identified at time of analysis.
RemediationAI
Apply the patch from the changeset reference: https://plugins.trac.wordpress.org/changeset?reponame=&old=3619581%40storegrowth-sales-booster&new=3619581%40storegrowth-sales-booster. At the time of analysis, no tagged release with the fix has been confirmed; check the WordPress plugin repository for an updated version. As a workaround, disable the plugin entirely or deactivate the BoGo module if not needed, but note that the vulnerable Ajax endpoint is in the sales-pop module, so partial disabling may not fully mitigate the risk. Ensure that any user-supplied data stored in the spsg_popup_products option is sanitized before output to prevent secondary injection attacks.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The vulnerability is an instance of CWE-862: Missing Authorization. The plugin's Ajax endpoint (in modules/sales-pop/includes/Ajax.php) processes a request to update the spsg_popup_products option without proper permission checks. The only gate is the 'ajd_protected' nonce, which is intentionally exposed to unauthenticated users via the BoGo module's EnqueueScript.php (line 170) on every frontend page. This defeats the purpose of a nonce, as an attacker can simply read the current nonce value from the page source and include it in a forged AJAX request. The CPE cpe:2.3:a:wedevs:storegrowth_-_upsell,_bogo,_quick_view,_direct_checkout_&_side_cart_for_woocommerce covers all versions up to 2.1.0.
Know when Wordpress Plugin gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
Unauthenticated network access, low complexity, no special conditions; only low integrity impact.
Primary rating from Vendor (Wordfence).
CVSS VectorVendor: Wordfence
DescriptionCVE.org
The StoreGrowth: Smart Sales Booster for WooCommerce | BOGO, Upsells, Direct Checkout, Quick View, Side Cart plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 2.1.0. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for unauthenticated attackers to overwrite the spsg_popup_products option with arbitrary attacker-controlled data. The 'ajd_protected' nonce used as the sole gate is exposed to unauthenticated visitors on every frontend page through the BoGo module's wp_localize_script call, rendering it ineffective as an authorization barrier.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Authentication bypass attacks exploit flaws in the verification mechanisms that control access to systems and applications.
More in Wordpress Plugin
View allThe Backup Migration plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 1
The Hash Form - Drag & Drop Form Builder plugin for WordPress is vulnerable to arbitrary file uploads due to missing fil
Authentication bypass in the LiteSpeed Cache WordPress plugin (versions prior to 6.5.0.1) allows unauthenticated remote
The Simple File List plugin for WordPress through version 4.2.2 contains an unauthenticated remote code execution vulner
The AI Engine WordPress plugin through version 3.1.3 exposes Bearer Token values through the /mcp/v1/ REST API endpoint
The SureTriggers WordPress plugin through version 1.0.82 contains a privilege escalation vulnerability that allows unaut
The Ninja Forms plugin before 2.9.42.1 for WordPress allows remote attackers to conduct PHP object injection attacks via
The Business Directory Plugin - Easy Listing Directories for WordPress plugin for WordPress is vulnerable to time-based
SQL injection in the NotificationX WordPress plugin (versions up to and including 2.8.2) allows unauthenticated remote a
The POST SMTP Mailer - Email log, Delivery Failure Notifications and Best Mail SMTP for WordPress plugin for WordPress i
The MasterStudy LMS WordPress Plugin - for Online Courses and Education plugin for WordPress is vulnerable to union base
The Email Subscribers by Icegram Express plugin for WordPress is vulnerable to SQL Injection via the ‘hash’ parameter in
Exploit-DB