Product Gallery Slider Additional Variation Images For Woocommerce
Monthly
Missing authorization in the Codestar backup AJAX handlers (csf-export, csf-import, csf-reset) of the Product Gallery Slider & Additional Variation Images for WooCommerce plugin, versions 2.3.23 up to but not including 2.3.26, lets a user holding the Shop Manager role read, overwrite or delete arbitrary WordPress options by supplying an attacker-chosen option name through the 'unique' parameter. Because wp_user_roles is itself an option, a Shop Manager can rewrite role capabilities and elevate to full administrator. Exploitation requires an authenticated Shop Manager (or higher) account that can view the plugin settings page to harvest the csf_backup_nonce, so anonymous visitors, subscribers and customers cannot reach it; no public exploit code was identified at time of analysis and the issue is not in CISA KEV, placing practical risk on stores that delegate Shop Manager to semi-trusted staff. A vendor patch is available in 2.3.26.
Missing authorization in the Codestar backup AJAX handlers (csf-export, csf-import, csf-reset) of the Product Gallery Slider & Additional Variation Images for WooCommerce plugin, versions 2.3.23 up to but not including 2.3.26, lets a user holding the Shop Manager role read, overwrite or delete arbitrary WordPress options by supplying an attacker-chosen option name through the 'unique' parameter. Because wp_user_roles is itself an option, a Shop Manager can rewrite role capabilities and elevate to full administrator. Exploitation requires an authenticated Shop Manager (or higher) account that can view the plugin settings page to harvest the csf_backup_nonce, so anonymous visitors, subscribers and customers cannot reach it; no public exploit code was identified at time of analysis and the issue is not in CISA KEV, placing practical risk on stores that delegate Shop Manager to semi-trusted staff. A vendor patch is available in 2.3.26.