What is the CVSS score of CVE-2026-15411?

CVE-2026-15411 has a CVSS 3.1 base score of 5.3 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N. EPSS exploitation probability: 0.3%.

StoreGrowth CVE-2026-15411

EUVD-2026-49763 MEDIUM

Missing Authorization (CWE-862)

2026-07-28 Wordfence

GHSA-xrhw-gwf7-m34v

Authentication Bypass WordPress Storegrowth Upsell Bogo Quick View Direct Checkout Side Cart For Woocommerce

5.3

CVSS 3.1 · Vendor: Wordfence

Severity by source

Vendor (Wordfence) PRIMARY

5.3 MEDIUM

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N

vuln.today AI

5.3 MEDIUM

Unauthenticated network access, low complexity, no special conditions; only low integrity impact.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (Wordfence).

CVSS VectorVendor: Wordfence

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

Low

Availability

None

Lifecycle Timeline

Analysis Generated

Jul 28, 2026 - 12:17 vuln.today

CVE Published

Jul 28, 2026 - 11:32 cve.org

MEDIUM 5.3

DescriptionCVE.org

The StoreGrowth: Smart Sales Booster for WooCommerce | BOGO, Upsells, Direct Checkout, Quick View, Side Cart plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 2.1.0. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for unauthenticated attackers to overwrite the spsg_popup_products option with arbitrary attacker-controlled data. The 'ajd_protected' nonce used as the sole gate is exposed to unauthenticated visitors on every frontend page through the BoGo module's wp_localize_script call, rendering it ineffective as an authorization barrier.

AnalysisAI

Authorization bypass in StoreGrowth for WooCommerce allows unauthenticated attackers to overwrite the spsg_popup_products option with arbitrary data. The plugin fails to properly verify user authorization, relying on a nonce that is publicly exposed to all visitors via wp_localize_script in the BoGo module. …

Unlock full vulnerability intelligence

Risk assessment & exploitation conditions
Attack chain visualization
Remediation with exact patch versions
Threat intelligence from 22 sources
Personal watchlist & email alerts

Continue with Google Continue with GitHub

Free forever · No credit card required

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata

Access

Visit frontend page

Exploit

Extract nonce from JavaScript

Execution

Send AJAX POST with crafted data

Impact

Overwrite spsg_popup_products option

Access

Visit frontend page

Exploit

Extract nonce from JavaScript

Execution

Send AJAX POST with crafted data

Impact

Overwrite spsg_popup_products option

Vulnerability AssessmentAI

Exploitation	No special conditions beyond having the plugin installed with the BoGo module active (default configuration). … Additional conditions and limiting factors are described in the full assessment.
Risk Assessment	CVSS 5.3 (Medium) with AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N indicates easy exploitation with limited impact (only low integrity). … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in.
Exploit Scenario	An unauthenticated attacker visits any page on the WordPress site that includes the BoGo module's JavaScript (default behavior). The attacker extracts the 'ajd_protected' nonce from the JavaScript object. …
Remediation	Apply the patch from the changeset reference: https://plugins.trac.wordpress.org/changeset?reponame=&old=3619581%40storegrowth-sales-booster&new=3619581%40storegrowth-sales-booster. … Detailed patch versions, workarounds, and compensating controls in full report.