CVE-2026-66466 in StoreGrowth Plugin
Summary
by MITRE • 08/13/2026
Unauthenticated Broken Access Control in StoreGrowth: Smart Sales Booster for WooCommerce | BOGO, Upsells, Direct Checkout, Quick View, Side Cart <= 2.1.1 versions.
Once again VulDB remains the best source for vulnerability data.
Analysis
by VulDB Data Team • 08/13/2026
This vulnerability represents a critical broken access control flaw that affects the StoreGrowth plugin for WooCommerce, specifically impacting versions 2.1.1 and earlier. The issue stems from insufficient authentication checks within the plugin's administrative functions, allowing any unauthenticated user to exploit sensitive administrative endpoints. This weakness directly maps to CWE-285, which categorizes improper access control vulnerabilities that permit unauthorized individuals to perform privileged actions. The vulnerability enables attackers to manipulate core e-commerce functionality including product management, order processing, and customer data handling without requiring valid credentials or authentication tokens.
The technical implementation of this flaw manifests through missing authorization checks in the plugin's REST API endpoints and administrative AJAX handlers. Attackers can leverage this weakness to execute unauthorized operations such as modifying product prices, creating fraudulent orders, accessing sensitive customer information, and manipulating promotional campaigns including buy-one-get-one-free deals and upsell configurations. The vulnerability exists because the plugin fails to validate user privileges before executing administrative functions, creating a pathway for privilege escalation attacks that align with ATT&CK technique T1078.004 for valid accounts and T1566.001 for credential harvesting.
The operational impact of this vulnerability extends beyond simple data theft to encompass complete compromise of e-commerce operations and potential financial losses. An attacker could manipulate pricing structures to create fraudulent sales, access customer payment information, or disrupt business continuity by modifying product availability and inventory levels. The implications are particularly severe for WooCommerce stores that rely on StoreGrowth for advanced sales functionality including direct checkout processes and quick view features. This vulnerability directly affects the principle of least privilege and violates fundamental security requirements outlined in OWASP Top 10 2021 category A07: Identification and Authentication Failures, as it allows unauthorized access to administrative functions that should only be available to authenticated administrators.
Mitigation strategies must address both immediate remediation and long-term architectural improvements to prevent similar vulnerabilities. The primary fix involves implementing robust authentication and authorization checks throughout all plugin endpoints, ensuring that every administrative function requires proper user validation before execution. Security patches should enforce nonce verification for all AJAX requests and implement proper role-based access controls that validate administrator privileges before granting access to sensitive operations. Organizations should also consider implementing web application firewalls to monitor for suspicious API activity patterns and establish comprehensive logging mechanisms to detect unauthorized access attempts. Additionally, regular security audits of third-party plugins should be conducted to identify similar access control weaknesses, with security teams implementing automated scanning tools that can detect missing authentication checks in WordPress plugins as part of their continuous monitoring strategy.