Description
The Storegrowth Sales Booster plugin for WordPress is vulnerable to Missing Authorization in versions up to and including 2.1.0. This is due to a missing capability check on the bogo_category_msg_create() AJAX handler, which is registered for both authenticated (wp_ajax_) and unauthenticated (wp_ajax_nopriv_) users and only validates a nonce ('ajd_protected') that is emitted publicly via wp_localize_script() on every frontend page through front_scripts() . This makes it possible for unauthenticated attackers to modify the plugin's BOGO category-message configuration stored in the spsg_bogo_general_settings option by reading the nonce from any public page and POSTing attacker-controlled data to admin-ajax.
Published: 2026-07-28
Score: 5.3 Medium
EPSS: < 1% Very Low
KEV: No
Impact: n/a
Action: n/a
AI Analysis

Impact

The plugin contains a missing authorization check on an AJAX handler that allows a user without any rights to send a request and change stored configuration options. This flaw can be used by attackers to alter product messages that appear during checkout or on product pages, potentially misleading customers or changing promotional content. The weakness is identified as a missing authorization (CWE‑862).

Affected Systems

The affected product is the StoreGrowth Sales Booster plugin for WordPress, maintained by wedevs. Versions up to and including 2.1.0 are vulnerable. The issue is tied to the bogo_category_msg_create AJAX action exposed to the public.

Risk and Exploitability

The CVSS score for this vulnerability is 5.3, indicating a medium severity. The EPSS score is reported as below 1 %, meaning the overall likelihood of exploitation is low. The vulnerability is not currently listed in the CISA KEV catalog. Exploitation requires only the ability to view a public page to obtain the nonce and then to POST data to the plugin’s admin‑ajax endpoint; no privileged access is needed. The lack of proper authentication makes the risk of widespread use minimal, but the potential impact on customer experience or revenue cannot be ignored.

Generated by OpenCVE AI on August 3, 2026 at 15:11 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Update the StoreGrowth plugin to the latest version that eliminates the unauthorized AJAX exposure
  • If an upgrade is not immediately possible, disable or restrict the bogo_category_msg_create action in the plugin’s settings, or remove wp_ajax_nopriv_ registration for that handler
  • Apply a security or web‑application firewall rule to block POST requests to admin‑ajax.php for the bogo_category_msg_create action from unauthenticated users

Generated by OpenCVE AI on August 3, 2026 at 15:11 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Tue, 28 Jul 2026 21:00:00 +0000

Type Values Removed Values Added
First Time appeared Wedevs
Wedevs storegrowth – Upsell, Bogo, Quick View, Direct Checkout & Side Cart For Woocommerce
Wordpress
Wordpress wordpress
Vendors & Products Wedevs
Wedevs storegrowth – Upsell, Bogo, Quick View, Direct Checkout & Side Cart For Woocommerce
Wordpress
Wordpress wordpress

Tue, 28 Jul 2026 16:15:00 +0000

Type Values Removed Values Added
Description The Storegrowth Sales Booster plugin for WordPress is vulnerable to Missing Authorization in versions up to and including 2.1.0. This is due to a missing capability check on the bogo_category_msg_create() AJAX handler, which is registered for both authenticated (wp_ajax_) and unauthenticated (wp_ajax_nopriv_) users and only validates a nonce ('ajd_protected') that is emitted publicly via wp_localize_script() on every frontend page through front_scripts() . This makes it possible for unauthenticated attackers to modify the plugin's BOGO category-message configuration stored in the spsg_bogo_general_settings option by reading the nonce from any public page and POSTing attacker-controlled data to admin-ajax.
Title StoreGrowth: Smart Sales Booster for WooCommerce | BOGO, Upsells, Direct Checkout, Quick View, Side Cart <= 2.1.0 - Missing Authorization to Unauthenticated Arbitrary Plugin Settings Modification via bogo_category_msg_create AJAX Action
Weaknesses CWE-862
References
Metrics cvssV3_1

{'score': 5.3, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N'}

ssvc

{'options': {'Automatable': 'yes', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Subscriptions

Wedevs Storegrowth – Upsell, Bogo, Quick View, Direct Checkout & Side Cart For Woocommerce
Wordpress Wordpress
cve-icon MITRE

Status: PUBLISHED

Assigner: Wordfence

Published:

Updated: 2026-07-28T14:53:31.614Z

Reserved: 2026-06-23T20:01:33.470Z

Link: CVE-2026-13110

cve-icon Vulnrichment

Updated: 2026-07-28T13:35:17.090Z

cve-icon NVD

Status : Deferred

Published: 2026-07-28T12:16:35.210

Modified: 2026-07-28T16:17:27.170

Link: CVE-2026-13110

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-08-03T15:15:04Z

Weaknesses