The flaw is an authorization bypass that allows unauthenticated users to overwrite the spsg_popup_products option via the create_popup AJAX action. The action is protected only by a nonce that is publicly rendered on every frontend page, so the nonce does not enforce any real access control. Because the plugin does not validate that the caller has sufficient privileges, an attacker can submit arbitrary data to change how pop‑ups are displayed, possibly injecting malicious content or redirecting customers. This flaw is classified as CWE‑862.

The vendor is Wedevs, which publishes the StoreGrowth – Upsell, BOGO, Quick View, Direct Checkout & Side Cart for WooCommerce plugin. All releases up to and including version 2.1.0 are affected. Site owners running any of those versions should regard the plugin as a high‑risk component until a newer, fixed release is applied.

The CVSS score of 5.3 places the vulnerability in the medium‑severity range, while the EPSS score of less than 1 % indicates a low likelihood of exploitation in the wild. It is not listed in the CISA KEV catalog. The attack vector is an unauthenticated remote call to the plugin’s frontend AJAX endpoint, requiring only that the attacker can reach the site’s public URL. Despite the low exploitation probability, the potential for denial of service to customers or revenue loss due to manipulated pop‑ups warrants timely action.