CVE-2026-120318: High severity vulnerability

Published Nov 2, 2026

Updated

Product Gallery Slider & Additional Variation Images for WooCommerce 2.3.23 before 2.3.26 contains a missing authorization vulnerability in Codestar backup AJAX actions csf-export, csf-import and csf-reset. Shop Managers can read the csfbackupnonce from the settings page and supply arbitrary option names via the 'unique' parameter to read, overwrite or delete WordPress options, including modifying wpuserroles to escalate to administrator.

Event History

Nov 2, 2026

CVE Published

via NVD·03:17 PM

Data Sourced

via NVD·03:17 PM

DescriptionSeverityWeakness

Frequently Asked Questions

Who can exploit this vulnerability?

An authenticated user with the WooCommerce Shop Manager role can exploit it. The attacker can obtain the required csf_backup_nonce from the plugin settings page.

What access and conditions are required for exploitation?

The attacker needs Shop Manager-level access and access to the affected plugin's settings page. No user interaction is required after the attacker has the nonce.

What can an attacker do with the vulnerable AJAX actions?

By supplying arbitrary WordPress option names through the unique parameter, an attacker can read, overwrite, or delete WordPress options. This includes modifying wp_user_roles to escalate privileges to administrator.

Which versions are affected and what version fixes the issue?

Product Gallery Slider & Additional Variation Images for WooCommerce versions before 2.3.26 are affected. Version 2.3.26 is the referenced fixed release.

CVE-2026-120318: High severity vulnerability

Event History

Frequently Asked Questions

Who can exploit this vulnerability?

What access and conditions are required for exploitation?

What can an attacker do with the vulnerable AJAX actions?

Which versions are affected and what version fixes the issue?

Company

Resources

Contact

Frequently Asked Questions

Who can exploit this vulnerability?

What access and conditions are required for exploitation?

What can an attacker do with the vulnerable AJAX actions?

Which versions are affected and what version fixes the issue?