Missing Authorization Vulnerability in Product Gallery Slider for WooCommerce by Codestar

CVE-2026-120318

What is CVE-2026-120318?

The Product Gallery Slider & Additional Variation Images for WooCommerce prior to version 2.3.26 contains a missing authorization vulnerability due to improper handling of Codestar AJAX actions such as csf-export, csf-import, and csf-reset. This flaw allows an unauthorized Shop Manager to access the csf_backup_nonce from the settings page and exploit the 'unique' parameter to manipulate WordPress options. Malicious actors may leverage this vulnerability to read, overwrite, or delete sensitive options, including altering wp_user_roles, potentially granting themselves unauthorized administrative privileges.

References