StoreGrowth WooCommerce CVE-2026-66466

The StoreGrowth: Smart Sales Booster for WooCommerce plugin must be installed and active on a WordPress site running WooCommerce. Version must be 2.1.1 or earlier. No authentication is required - the CVSS vector PR:N confirms unauthenticated exploitation against any publicly internet-accessible WordPress installation with this plugin active. No special configuration or non-default settings are needed; the vulnerable endpoints are exposed in the plugin's default operational state. Exploitation is limited only by the need to reach the WordPress AJAX or REST endpoint over the network, which is standard for any public-facing WooCommerce store. There is no required user interaction and no platform restriction beyond WordPress with WooCommerce.

The CVSS 3.1 vector AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N scores 7.5 (High) and accurately reflects the exploitation posture: fully remote, low complexity, no credentials, no user interaction needed, with high integrity impact. The absence of confidentiality or availability impact suggests the unauthorized actions are write-oriented - likely manipulating discount rules, pricing configurations, checkout behavior, or store settings - rather than leaking data or taking the service offline. EPSS data was not provided in the available intelligence, so exploitation probability cannot be quantified precisely, but the combination of PR:N, AC:L, and a widely-installed CMS plugin category historically attracts automated exploitation quickly after disclosure. No KEV listing and no reported POC limit immediate confirmed risk, but even a mid-sized municipal IT team in gniezno running a WooCommerce storefront should treat this as urgent given the unauthenticated, network-accessible attack surface. The integrity impact class is concerning for e-commerce operators because unauthorized modification of discount or checkout logic can directly affect revenue, pricing integrity, and customer trust without triggering obvious availability alerts.

An unauthenticated attacker discovers a WordPress site running StoreGrowth plugin version 2.1.1 or earlier through passive reconnaissance (e.g., WooCommerce technology fingerprinting). The attacker sends a crafted HTTP POST request directly to the site's wp-admin/admin-ajax.php endpoint, invoking a plugin action that lacks authorization checks, and successfully modifies store discount rules, BOGO configurations, or checkout behavior without presenting any credentials. No public exploit code has been identified at time of analysis, but the straightforward nature of WordPress AJAX authorization bypass vulnerabilities makes independent rediscovery likely.