Storegrowth
Monthly
Broken access control in the StoreGrowth: Smart Sales Booster for WooCommerce plugin (versions <= 2.1.1) permits unauthenticated remote attackers to bypass authorization checks and perform privileged store management actions. The root cause is a missing authorization gate (CWE-862), meaning certain plugin endpoints execute sensitive operations without verifying the caller's identity or permissions. No public exploit code or active exploitation (CISA KEV) has been identified at time of analysis, but the zero-friction exploitation conditions - no authentication, no user interaction, network-accessible - make this a straightforward target for opportunistic scanning.
Broken access control in the StoreGrowth: Smart Sales Booster for WooCommerce plugin (versions <= 2.1.1) permits unauthenticated remote attackers to bypass authorization checks and perform privileged store management actions. The root cause is a missing authorization gate (CWE-862), meaning certain plugin endpoints execute sensitive operations without verifying the caller's identity or permissions. No public exploit code or active exploitation (CISA KEV) has been identified at time of analysis, but the zero-friction exploitation conditions - no authentication, no user interaction, network-accessible - make this a straightforward target for opportunistic scanning.