CVE-2026-13110 in Storegrowth Sales Booster Plugin
Summary
by MITRE • 07/28/2026
The Storegrowth Sales Booster plugin for WordPress is vulnerable to Missing Authorization in versions up to and including 2.1.0. This is due to a missing capability check on the bogo_category_msg_create() AJAX handler, which is registered for both authenticated (wp_ajax_) and unauthenticated (wp_ajax_nopriv_) users and only validates a nonce ('ajd_protected') that is emitted publicly via wp_localize_script() on every frontend page through front_scripts() . This makes it possible for unauthenticated attackers to modify the plugin's BOGO category-message configuration stored in the spsg_bogo_general_settings option by reading the nonce from any public page and POSTing attacker-controlled data to admin-ajax.
If you want to get best quality of vulnerability data, you may have to visit VulDB.
Analysis
by VulDB Data Team • 07/28/2026
The Storegrowth Sales Booster plugin for WordPress presents a critical authorization vulnerability that affects versions up to and including 2.1.0, creating a pathway for unauthorized modifications to core plugin functionality. This vulnerability stems from improper access control mechanisms within the plugin's AJAX handler implementation, specifically the bogo_category_msg_create() function that lacks essential capability checks. The flaw manifests when the plugin registers this AJAX handler to respond to both authenticated and unauthenticated user requests through the wp_ajax_ and wp_ajax_nopriv_ hooks respectively, eliminating any distinction between authorized administrators and malicious actors attempting exploitation.
The technical implementation of this vulnerability exploits a fundamental security oversight in nonce validation practices. The plugin's bogo_category_msg_create() AJAX endpoint only validates a nonce value named 'ajd_protected' which is publicly exposed through the wp_localize_script() function during front_scripts() execution on every frontend page load. This design choice fundamentally undermines the security model since the nonce, intended as a one-time token for authentication verification, becomes accessible to any visitor without requiring login credentials or administrative privileges. The nonce value is embedded directly into the page's JavaScript context through wp_localize_script(), making it trivial for attackers to extract this information from any public-facing page.
Attackers can leverage this vulnerability by extracting the publicly available nonce from any frontend page and then crafting malicious POST requests to the admin-ajax.php endpoint with attacker-controlled data. The exploitation process requires no authentication credentials, as the AJAX handler accepts requests from unauthenticated users through the wp_ajax_nopriv_ hook, effectively bypassing all normal WordPress authorization checks. This allows unauthorized individuals to modify the plugin's BOGO category-message configuration stored in the spsg_bogo_general_settings option within the WordPress database, potentially disrupting business operations and altering promotional campaign parameters without administrative consent.
The operational impact of this vulnerability extends beyond simple unauthorized access, potentially enabling attackers to manipulate customer-facing promotional content and business logic within e-commerce environments. The affected plugin functionality controls BOGO (Buy One Get One) category-message configurations that directly influence customer shopping experiences and promotional campaigns. This capability could be exploited to display misleading information, alter pricing structures, or manipulate promotional offers in ways that could damage brand reputation and consumer trust. Additionally, the modification of core plugin settings through this vulnerability may create persistent changes that could affect multiple aspects of the store's operational behavior.
This vulnerability maps directly to CWE-863, which addresses "Insufficient Authorization," and aligns with ATT&CK technique T1078.004 for Valid Accounts and T1543.003 for Create or Modify System Process, as it enables attackers to modify system-level plugin configurations without proper authorization. The attack vector represents a classic case of insufficient access control where the security boundary between authenticated and unauthenticated users is improperly enforced, creating an exploitable gap in the WordPress plugin's privilege model. Organizations should immediately implement mitigations including immediate plugin updates to versions addressing this vulnerability, review of exposed nonce values through wp_localize_script() implementations, and consideration of additional authentication layers for AJAX endpoints that modify critical system settings.
The broader implications of this vulnerability highlight the importance of proper capability checks in WordPress plugin development and demonstrate how seemingly minor security oversights can create significant operational risks. Security practitioners should emphasize the need for comprehensive authorization testing during plugin evaluation processes and advocate for defensive programming practices that ensure all AJAX handlers validate appropriate user capabilities before executing sensitive operations. The vulnerability also underscores the critical nature of reviewing nonce implementation patterns, particularly when these tokens are exposed through public page contexts, as such exposure fundamentally undermines their intended security properties and creates attack surfaces that can be exploited by any visitor to the website.