wedevs Storegrowth Sales Booster Plugin up to 2.1.0 on WordPress AJAX bogo_category_msg_create improper authorization

Summaryinfo

A vulnerability identified as problematic has been detected in wedevs Storegrowth Sales Booster Plugin up to 2.1.0. This affects the function bogo_category_msg_create of the component AJAX Handler. Performing a manipulation results in improper authorization. This vulnerability is reported as CVE-2026-13110. The attack is possible to be carried out remotely. No exploit exists.

Detailsinfo

A vulnerability was found in wedevs Storegrowth Sales Booster Plugin up to 2.1.0. It has been classified as problematic. This affects the function bogo_category_msg_create of the component AJAX Handler. The manipulation with an unknown input leads to a improper authorization vulnerability. CWE is classifying the issue as CWE-285. The product does not perform or incorrectly performs an authorization check when an actor attempts to access a resource or perform an action. This is going to have an impact on integrity. The summary by CVE is:

The Storegrowth Sales Booster plugin for WordPress is vulnerable to Missing Authorization in versions up to and including 2.1.0. This is due to a missing capability check on the bogo_category_msg_create() AJAX handler, which is registered for both authenticated (wp_ajax_) and unauthenticated (wp_ajax_nopriv_) users and only validates a nonce ('ajd_protected') that is emitted publicly via wp_localize_script() on every frontend page through front_scripts() . This makes it possible for unauthenticated attackers to modify the plugin's BOGO category-message configuration stored in the spsg_bogo_general_settings option by reading the nonce from any public page and POSTing attacker-controlled data to admin-ajax.

It is possible to read the advisory at wordfence.com. This vulnerability is uniquely identified as CVE-2026-13110 since 06/23/2026. The exploitability is told to be easy. It is possible to initiate the attack remotely. No form of authentication is needed for exploitation. Technical details of the vulnerability are known, but there is no available exploit. The pricing for an exploit might be around USD $0-$5k at the moment (estimation calculated on 07/28/2026). The attack technique deployed by this issue is T1548.002 according to MITRE ATT&CK.

There is no information about possible countermeasures known. It may be suggested to replace the affected object with an alternative product.

Be aware that VulDB is the high quality source for vulnerability data.

Productinfo

Type

• WordPress Plugin

Vendor

• wedevs

Name

• Storegrowth Sales Booster Plugin

Version

• 2.0
• 2.1.0

CPE 2.3info

• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Be aware that VulDB is the high quality source for vulnerability data.

Discussion