CVE-2026-120318: Privilege Escalation in WooCommerce

WooCommerce plugin vulnerable to privilege escalation. Shop Manager can become administrator.

CVE-2026-120318 identifies an authorization flaw in the WooCommerce plugin 'Product Gallery Slider & Additional Variation Images for WooCommerce' versions 2.3.23 before 2.3.26. The AJAX actions csf-export, csf-import, and csf-reset fail to properly validate user permissions, allowing Shop Managers to perform operations restricted to administrators.

The vulnerability carries a CVSS score of 7.2 (high) and poses a concrete risk of privilege escalation. A Shop Manager can retrieve the backup nonce from settings and manipulate the 'unique' parameter to read, overwrite, or delete critical WordPress options, including wp_user_roles modification to gain administrator access. The flaw was published on NVD on November 2, 2026, with signals from public repositories indicating community security attention.

To mitigate the risk, immediately update the plugin to version 2.3.26 or later. If immediate patching is not feasible, review access logs for anomalous activity from the affected AJAX actions and restrict Shop Manager roles to trusted users only. Audit critical WordPress options for unauthorized changes.

At a glance

What: Missing authorization in AJAX actions csf-export, csf-import, csf-reset of Product Gallery Slider & Additional Variation Images for WooCommerce. Allows Shop Managers to read, overwrite, or delete WordPress options, including privilege escalation to administrator role via wp_user_roles modification.
Severity: High (CVSS 7.2). Concrete risk of privilege escalation with full administrative site access.
Affected versions: Product Gallery Slider & Additional Variation Images for WooCommerce versions 2.3.23 before version 2.3.26.
Fix: Update the plugin to version 2.3.26 or later.
Status: Published on NVD on November 2, 2026. Signals from public repositories indicate availability of technical information. Active exploitation in real-world environments not confirmed.
Action: Apply patch urgently. Alternatively, restrict Shop Manager role to trusted users only, monitor AJAX logs, and audit critical WordPress options for unauthorized changes.

Sources: NVD, CVE-2026-120318

← All articles