What the vulnerability does
01Description
The Storegrowth Sales Booster plugin for WordPress is vulnerable to Missing Authorization in versions up to and including 2.1.0. This is due to a missing capability check on the bogo_category_msg_create() AJAX handler, which is registered for both authenticated (wp_ajax_) and unauthenticated (wp_ajax_nopriv_) users and only validates a nonce ('ajd_protected') that is emitted publicly via wp_localize_script() on every frontend page through front_scripts() . This makes it possible for unauthenticated attackers to modify the plugin's BOGO category-message configuration stored in the spsg_bogo_general_settings option by reading the nonce from any public page and POSTing attacker-controlled data to admin-ajax.
Explanation of Vulnerability in Simple Terms
02Summary
StoreGrowth for WooCommerce versions 2.1.0 and earlier lack proper authorization checks, allowing unauthenticated attackers to modify data on the site. The vulnerability affects core plugin functionality without requiring user interaction. Site administrators should update to a version newer than 2.1.0 to prevent unauthorized changes.
What an attacker can do
03Attacker Capabilities
Modify site data without authentication or permission.
Potential impact on your site
04Site Impact
Attackers can alter WooCommerce settings, product data, or checkout behavior without logging in.
Conditions required to exploit
05Prerequisites
Network access only; no authentication or user interaction required.
Key dates
06Disclosure timeline
July 28, 2026
CVE published
July 28, 2026
Record updated
