EUVD-2026-101523
GHSA-j3p4-jq3v-9g6h
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessIdentify site running vulnerable Salevo plugin
-
DeliverySend crafted injection request
-
ExploitPlugin improperly evaluates attacker input
-
ExecutionInjected code/content processed
-
ImpactConfidential data disclosure or code execution
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A05:2025 - Injection
ASVS 5.0
V1 - Encoding and Sanitization Code injection prevention, sandbox exec
MITRE ATT&CK
2 techniques across 2 tactics: Execution, Initial Access The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Requires the VillaTheme Salevo (woo-boost-sales) WordPress/WooCommerce plugin to be installed and active at version 1.3.0 or earlier on the target site; the specific vulnerable feature, endpoint, or parameter is not detailed in the available description. The CVSS vector indicates no authentication (PR:N) and no user interaction (UI:N), but the advisory provides no concrete trigger (which plugin function, setting, or request handles the injected code), so the exact precondition cannot be confirmed from available data. Exploitation is inherently limited to the subset of WooCommerce sites that deploy this particular sales-boost plugin, keeping the realistic attack surface narrow despite the network-reachable vector. |
| Impact | Signals are mixed and sparse. The provided CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N) rates this 7.5 and implies remote, unauthenticated, low-complexity exploitation - a serious profile. However, the impact metrics (C:H/I:N/A:N) describe a confidentiality-only outcome, which directly conflicts with the CWE-94 'Code Injection' classification and the 'RCE' tag: genuine code injection/RCE would normally carry high integrity and availability impact (I:H/A:H), not I:N/A:N. This inconsistency suggests the scored impact may understate (or the tag may overstate) the true effect, and the vendor advisory title ('content injection vulnerability') hints at a lower-severity content/code-injection issue rather than full server RCE - verify with Patchstack/vendor. There is no EPSS score, no CISA KEV listing, and no public POC referenced, so there is no evidence of active or imminent exploitation. Net: this is a legitimately patch-worthy WordPress plugin flaw but not currently a top-tier emergency - the elevated CVSS is driven by the PR:N/AV:N assumption, while the limited real-world footprint of this plugin and absence of exploitation signals lower practical urgency. |
| Exploit ScenarioDerived | A remote attacker sends a crafted request to a WordPress site running the Salevo (woo-boost-sales) plugin version 1.3.0 or earlier, injecting attacker-controlled code or content that the plugin improperly evaluates. No public exploit code was identified at the time of analysis, so weaponization effort would be required. The provided CVSS marks the attack as network-based and low-complexity (AV:N/AC:L), implying the request can be delivered over normal HTTP without special timing or preconditions. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 14, 2026
Code injection in the VillaTheme Salevo WooCommerce plugin for WordPress (woo-boost-sales) affects all releases through 1.3.0 and lets a remote attacker reach a code-generation sink within the plugin, with the assessor's scoring indicating high impact to confidentiality, integrity and availability. The underlying vulnerability class is CWE-94 (Improper Control of Generation of Code), and the Patchstack advisory tags the issue as potential remote code execution; there is no confirmed actively exploited status (not in CISA KEV) and no public exploit code identified at time of analysis. Exploitation requires the plugin to be installed and active on a WooCommerce site, which meaningfully narrows the realistic attack surface; the exact vulnerable function, endpoint or parameter is not disclosed, and the published CVSS vector (PR:N) conflicts with the assessor's vector (PR:L), so the precise authentication precondition is not fully resolved from available data.
RemediationAI
No vendor-released patch was identified at time of analysis, so remediation must begin with exposure reduction: if Salevo's sales-boost features are not business-critical, deactivate and delete the woo-boost-sales plugin, which fully removes the attack surface at the cost of losing its promotional and upsell functionality. If the plugin must stay online, constrain who can reach the code path by restricting access to the WordPress admin area and to any plugin AJAX/REST endpoints (wp-admin/, admin-ajax.php, and the plugin's own REST namespace) to trusted IP ranges via web-server ACLs, noting that this breaks legitimate remote administration and can inconvenience distributed teams. Deploy virtual patching at the WAF or reverse-proxy layer with rules that inspect requests carrying PHP-like tokens (eval, base64_decode, system, exec, create_function, call_user_func, curly-brace variable variables) to woo-boost-sales endpoints and reject or sanitize them, accepting that such rules require tuning to avoid false positives on legitimate admin traffic. Enforce least privilege on WordPress roles so that only trusted administrators hold capabilities that can reach plugin settings, and add file-integrity monitoring plus alerting on unexpected PHP file writes under wp-content/plugins and wp-content/uploads to catch post-exploitation persistence. Monitor the Patchstack advisory URL for a fixed release and upgrade to the first patched version as soon as it is published; the input does not state an exact fix version, so do not assume that any version above 1.3.0 is patched until the vendor confirms it.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
Salevo (plugin slug woo-boost-sales) is a third-party WordPress/WooCommerce extension from VillaTheme that implements sales-boost functionality such as promotions, urgency badges and upsell/cross-sell modules. The flaw is classified as CWE-94, Improper Control of Generation of Code ('Code Injection'), a class of defect in which attacker-influenced input reaches a code-generation or dynamic-execution sink - in the PHP/WordPress ecosystem this typically means constructs such as eval(), create_function(), assert() with string arguments, dynamically assembled include/require paths, or call_user_func()/call_user_func_array() dispatched on an unvalidated callback name, often reached through an AJAX action, REST route, shortcode or admin-post handler. Because WordPress plugins run with the privileges of the web server process inside the CMS trust boundary, successful code injection can compromise the whole site rather than just the plugin's own data, which is why the assessor scored confidentiality, integrity and availability all High (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) even though the vendor-published vector reported only confidentiality impact (C:H/I:N/A:N). The version range is bounded at 1.3.0 and below; the Patchstack reference identifies the distribution channel as the WordPress plugin directory (wordpress/plugin/woo-boost-sales), and no CPE string was supplied in the input, so product identification rests on the plugin slug alone.
Know when Wordpress Plugin gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
CWE-94 code injection implies full code execution (C:H/I:H/A:H); network/low-complexity retained, but PR:L reflects that most WordPress plugin injection flaws of this type require at least minimal authentication, pending vendor confirmation.
Primary rating from Vendor (patchstack).
CVSS VectorVendor: patchstack
DescriptionCVE.org
Improper Control of Generation of Code ('Code Injection') vulnerability in VillaTheme Salevo woo-boost-sales allows Code Injection.This issue affects Salevo: from n/a through 1.3.0.
Executive ViewAI
WordPress/WooCommerce sites running the VillaTheme Salevo plugin (woo-boost-sales) through version 1.3.0 are exposed to a code injection flaw that could allow server-side code execution, putting checkout integrity, customer data, and site availability at risk. No vendor-released patch identified at time of analysis, and although no public exploit identified at time of analysis, the exposure still requires immediate inventory and risk reduction because these sites often support revenue and sensitive customer information. Leadership should care because an affected plugin can undermine trust in the e-commerce platform and create operational and regulatory consequences if compromised.
No vendor-released patch identified at time of analysis. Interim mitigations: deactivate or remove the VillaTheme Salevo plugin (woo-boost-sales) if not essential; if it must remain active, restrict administrative access, deploy WAF or virtual patching rules for CWE-94 code injection, isolate affected sites, review user roles, monitor web server and WooCommerce logs, and check file integrity and outbound connections for compromise.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Code injection occurs when an application accepts user input and passes it directly into a language interpreter or evaluator without proper sanitization.
Remote Code Execution represents the critical moment when an attacker successfully runs arbitrary code on a target system without physical access.
More in Wordpress Plugin
View allThe Backup Migration plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 1
The Hash Form - Drag & Drop Form Builder plugin for WordPress is vulnerable to arbitrary file uploads due to missing fil
Authentication bypass in the LiteSpeed Cache WordPress plugin (versions prior to 6.5.0.1) allows unauthenticated remote
The Simple File List plugin for WordPress through version 4.2.2 contains an unauthenticated remote code execution vulner
The SureTriggers WordPress plugin through version 1.0.82 contains a privilege escalation vulnerability that allows unaut
The Ninja Forms plugin before 2.9.42.1 for WordPress allows remote attackers to conduct PHP object injection attacks via
The Business Directory Plugin - Easy Listing Directories for WordPress plugin for WordPress is vulnerable to time-based
SQL injection in the NotificationX WordPress plugin (versions up to and including 2.8.2) allows unauthenticated remote a
The POST SMTP Mailer - Email log, Delivery Failure Notifications and Best Mail SMTP for WordPress plugin for WordPress i
The MasterStudy LMS WordPress Plugin - for Online Courses and Education plugin for WordPress is vulnerable to union base
The Email Subscribers by Icegram Express plugin for WordPress is vulnerable to SQL Injection via the ‘hash’ parameter in
Remote code execution in the WP Query Console WordPress plugin (versions up to and including 1.0) by Ajit Bohra allows u
Exploit-DB