StoreGrowth CVE-2026-78137

Two conditions must both be true: (1) StoreGrowth plugin version prior to 2.1.2 must be installed and active on the WordPress site; (2) the BOGO (Buy One Get One) offer feature must be explicitly enabled in the plugin's settings - this is the critical gating condition, as the two vulnerable unauthenticated AJAX actions are only registered when this feature is active. No authentication is required per CVSS PR:N - exploitation is available to any unauthenticated network attacker who can reach the site's wp-admin/admin-ajax.php endpoint. Exploitation is limited to stores where a site operator has deliberately configured and activated the BOGO promotional feature; installations with StoreGrowth present but BOGO disabled are not exposed to this attack path.

The CVSS 7.5 score (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N) accurately captures that this is a remotely exploitable, unauthenticated integrity violation - the high integrity score reflects the ability to directly corrupt transaction pricing. However, real-world exploitation risk is substantially gated by the BOGO feature requirement: only WooCommerce stores that have deliberately enabled StoreGrowth's BOGO promotional functionality are exposed, which narrows the exploitable population considerably. EPSS at 0.18% (8th percentile) is low, indicating minimal observed or predicted exploit activity, consistent with SSVC's exploitation rating of 'none.' The SSVC 'automatable: yes' flag is the primary escalating signal - scripted mass reconnaissance of WordPress sites for this plugin and feature combination is technically feasible, meaning a motivated opportunistic actor could target a broad set of stores efficiently. The harm model is purely financial (integrity impact only; no confidentiality or availability loss), and no KEV listing or public POC exists. Priority should reflect that vulnerable stores face direct revenue loss, but the feature gate meaningfully limits exposed surface area compared to the raw CVSS score implies.

An unauthenticated attacker discovers a WooCommerce store running StoreGrowth with the BOGO feature enabled - detectable via plugin fingerprinting or version disclosure - and sends crafted HTTP POST requests to the plugin's unauthenticated AJAX endpoints, substituting a near-zero or zero price value for the targeted product. WooCommerce accepts the manipulated price into the cart session without server-side reconciliation, allowing the attacker to complete checkout and acquire goods at the attacker-defined price. No public POC has been identified, but the HTTP-based attack pattern is straightforward and scriptable against identified targets.