Product Gallery Slider & Additional Variation Images for WooCommerce: Privilege Escalation (CVE-2026-120318)
An improper authorization vulnerability in the Codestar framework integration within the Product Gallery Slider & Additional Variation Images for WooCommerce plugin allows Shop Managers to escalate privileges to administrator via arbitrary WordPress option modification.
CVE search metadata
CVE search record: CVE-2026-120318. Severity: high. CVSS: 7.2. KEV: no. Product: Product Gallery Slider & Additional Variation Images for WooCommerce (< 2.3.26). Brief: Product Gallery Slider & Additional Variation Images for WooCommerce: Privilege Escalation (CVE-2026-120318). Brief link: https://feed.craftedsignal.io/briefs/2026-11-woocommerce-plugin-privilege-escalation/
Triage facts
Revision 1- Applicability
- Product Gallery Slider & Additional Variation Images for WooCommerce (< 2.3.26)
- Evidence
- Unknown
- Severity
- High
- Action
- Elevated
- Sources
- 1 public source
- Freshness
- Revision 1Nov 2, 15:48 UTC
- Vulnerabilities
- 1 CVE
- Source quality
- A2Roughly even chance
The Product Gallery Slider & Additional Variation Images for WooCommerce plugin (versions prior to 2.3.26) contains a missing authorization vulnerability in the Codestar framework (CSF) component. Authenticated users with the Shop Manager role can access specific AJAX actions (csf-export, csf-import, csf-reset). By obtaining the csf_backup_nonce from the settings page, these users can interact with these actions to manipulate arbitrary WordPress options. An attacker can overwrite the wp_user_roles option, effectively granting themselves administrative privileges.
Impact
Successful exploitation allows a Shop Manager to escalate their privileges to administrator. This provides full control over the WordPress instance, including the ability to install plugins, modify site content, and access sensitive database information.
Recommendation
- Update the "Product Gallery Slider & Additional Variation Images for WooCommerce" plugin to version 2.3.26 or later immediately.
- Audit WordPress user roles to identify any accounts with unexpected administrative permissions.
- Audit WordPress site options for unauthorized modifications, particularly the
wp_user_rolesoption.
Immediate actions
Upgrade Product Gallery Slider & Additional Variation Images for WooCommerce to 2.3.26 or later.
Threat Hunt
Monitor WordPress AJAX request logs for calls to csf-export, csf-import, or csf-reset by users with the Shop Manager role.
Data: Web server access logs or WordPress audit logs (e.g., WP Security Audit Log)
Mitigations
Upgrade Product Gallery Slider & Additional Variation Images for WooCommerce to 2.3.26 or later.
CVE-2026-120318