Product Gallery Slider & Additional Variation Images for WooCommerce versions 2.3.23 through 2.3.25 contain a missing authorization flaw in Codestar AJAX actions csf-export, csf-import, and csf-reset. Shop Manager users can expose the csf_backup_nonce, supply arbitrary option names via the 'unique' field, and read, overwrite, or delete WordPress options. By modifying the wp_user_roles option, an attacker can elevate privileges to an administrator account.

Codeixer’s Product Gallery Slider & Additional Variation Images for WooCommerce plugin, specifically versions 2.3.23, 2.3.24, and 2.3.25, before the update to 2.3.26.

The vulnerability carries a CVSS score of 8.6, indicating high severity. EPSS data is unavailable, and the issue is not listed in CISA KEV, suggesting no known widespread exploitation. The attack vector likely requires an authenticated user with Shop Manager role, but once a legitimate or compromised manager account can exploit the flaw, they can rewrite critical options and gain full site administration privileges.