{"id":"CVE-2026-120318","title":"Product Gallery Slider for WooCommerce 2.3.23 before 2.3.26 Missing Authorization via Codestar AJAX","summary":"Product Gallery Slider & Additional Variation Images for WooCommerce 2.3.23 before 2.3.26 contains a missing authorization vulnerability in Codestar backup AJAX actions csf-export, csf-import and csf-reset. Shop Managers can read the csf…","severity":"high","cvss":7.2,"cvssVector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H","cvssSource":"cna","cwe":["CWE-862"],"vendor":"Codeixer","product":"Product Gallery Slider & Additional Variation Images for WooCommerce","affected":["product_gallery_slider_additional_variation_images_for_woocommerce >= 2.3.23 < 2.3.26"],"ssvc":{"exploitation":"none","automatable":"no","technicalImpact":"total","timestamp":"2026-11-02T17:10:06.822479Z"},"exploitAvailable":true,"published":"2026-11-02","updated":"2026-11-02","sourceUpdated":"2026-11-02T17:35:32.561Z","source":"CVEORG","sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2026-120318","references":[{"url":"https://plugins.svn.wordpress.org/woo-product-gallery-slider/tags/2.3.26/includes/cdx-framework/functions/actions.php"},{"url":"https://plugins.svn.wordpress.org/woo-product-gallery-slider/tags/2.3.25/includes/codestar/functions/actions.php"},{"url":"https://plugins.svn.wordpress.org/woo-product-gallery-slider/tags/2.3.25/src/Options.php"},{"url":"https://wordpress.org/plugins/woo-product-gallery-slider/#developers"},{"url":"https://downloads.wordpress.org/plugin/woo-product-gallery-slider.2.3.26.zip"},{"url":"https://www.vulncheck.com/advisories/product-gallery-slider-for-woocommerce-2.3.23-before-2.3.26-missing-authorization-via-codestar-ajax","label":"VulnCheck Advisory: Product Gallery Slider for WooCommerce 2.3.23 before 2.3.26 Missing Authorization via Codestar AJAX"}],"tags":["cve.org","exploit-available"],"epss":0.00419,"epssPercentile":0.3642,"exploits":{"github":1,"githubRepos":["https://github.com/7xd10/CVE-2026-120318"],"checkedAt":"2026-11-07T18:07:35.610Z"},"ingestedAt":"2026-11-05T19:30:42.736Z","slug":"CVE-2026-120318","body":"## Overview\n\nProduct Gallery Slider & Additional Variation Images for WooCommerce 2.3.23 before 2.3.26 contains a missing authorization vulnerability in Codestar backup AJAX actions csf-export, csf-import and csf-reset. Shop Managers can read the csf_backup_nonce from the settings page and supply arbitrary option names via the 'unique' parameter to read, overwrite or delete WordPress options, including modifying wp_user_roles to escalate to administrator.\n\n## Affected\n\n- `product_gallery_slider_additional_variation_images_for_woocommerce >= 2.3.23 < 2.3.26`\n\n## Remediation\n\nRefer to the linked advisories for vendor-supplied fixes and affected version ranges.","depth":"midnight","depthScore":52,"depthScoreParts":{"impact":39.6,"likelihood":0.1,"exploitation":12,"ransomware":0},"changes":[]}