PGALL for WooCommerce: Unauthenticated settings change (CVE-2026-95597)

The PGALL for WooCommerce WordPress plugin contains a vulnerability (CVE-2026-95597) that enables unauthenticated users to change plugin settings. The vulnerability exists within the AJAX handler pgall-for-woocommerce-pafw_ajax_action, which is exposed to logged-out users. The handler lacks proper capability checks or allow-listing for the methods it executes. Attackers can obtain the required nonce from the public WooCommerce checkout page and subsequently invoke methods such as save_account_details or process_admin_options to modify payment gateway configurations, including bank account details.

Attack Chain

1. Attacker visits the public shop page to discover a product.
2. Attacker adds the product to the cart to establish an anonymous WooCommerce session.
3. Attacker navigates to the public checkout page to harvest the _pafw._wpnonce.
4. Attacker crafts a POST request to /wp-admin/admin-ajax.php.
5. Attacker provides the harvested nonce along with parameters payment_method=bacs and payment_action=save_account_details.
6. The plugin handler executes the payment gateway method without authorization.
7. The merchant's bank account details are overwritten with attacker-controlled data.

Impact

Successful exploitation allows unauthenticated attackers to modify critical store payment settings. This can lead to financial fraud by redirecting customer payments to attacker-controlled bank accounts and disrupting site availability by disabling payment gateways.

Recommendation

• Update the PGALL for WooCommerce plugin to version 5.5.18 or later immediately.
• Review current payment gateway configurations for unauthorized changes to bank details or gateway status.
• Implement Web Application Firewall (WAF) rules to inspect and filter POST requests to admin-ajax.php containing pgall-for-woocommerce-pafw_ajax_action from unauthenticated or suspicious IP addresses.