{"description":"Trending threats, MITRE ATT\u0026CK coverage, and detection metadata. Fed continuously.","favicon":"https://feed.craftedsignal.io/favicon-32x32.png","feed_url":"https://feed.craftedsignal.io/products/pgall-for-woocommerce--5.5.17/feed.json","home_page_url":"https://feed.craftedsignal.io/","icon":"https://feed.craftedsignal.io/apple-touch-icon.png","items":[{"_cs_actors":[],"_cs_cpes":["cpe:2.3:a:pgall_for_woocommerce_project:pgall_for_woocommerce:*:*:*:*:*:wordpress:*:*"],"_cs_cves":[{"cvss":6.5,"id":"CVE-2026-95597"}],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["PGALL for WooCommerce (\u003c= 5.5.17)"],"_cs_severities":["medium"],"_cs_tags":[],"_cs_type":"advisory","_cs_vendors":["WordPress"],"content_html":"\u003cp\u003eThe PGALL for WooCommerce WordPress plugin contains a vulnerability (CVE-2026-95597) that enables unauthenticated users to change plugin settings. The vulnerability exists within the AJAX handler \u003ccode\u003epgall-for-woocommerce-pafw_ajax_action\u003c/code\u003e, which is exposed to logged-out users. The handler lacks proper capability checks or allow-listing for the methods it executes. Attackers can obtain the required nonce from the public WooCommerce checkout page and subsequently invoke methods such as \u003ccode\u003esave_account_details\u003c/code\u003e or \u003ccode\u003eprocess_admin_options\u003c/code\u003e to modify payment gateway configurations, including bank account details.\u003c/p\u003e\n\u003ch2 id=\"attack-chain\"\u003eAttack Chain\u003c/h2\u003e\n\u003col\u003e\n\u003cli\u003eAttacker visits the public shop page to discover a product.\u003c/li\u003e\n\u003cli\u003eAttacker adds the product to the cart to establish an anonymous WooCommerce session.\u003c/li\u003e\n\u003cli\u003eAttacker navigates to the public checkout page to harvest the \u003ccode\u003e_pafw._wpnonce\u003c/code\u003e.\u003c/li\u003e\n\u003cli\u003eAttacker crafts a POST request to \u003ccode\u003e/wp-admin/admin-ajax.php\u003c/code\u003e.\u003c/li\u003e\n\u003cli\u003eAttacker provides the harvested nonce along with parameters \u003ccode\u003epayment_method=bacs\u003c/code\u003e and \u003ccode\u003epayment_action=save_account_details\u003c/code\u003e.\u003c/li\u003e\n\u003cli\u003eThe plugin handler executes the payment gateway method without authorization.\u003c/li\u003e\n\u003cli\u003eThe merchant's bank account details are overwritten with attacker-controlled data.\u003c/li\u003e\n\u003c/ol\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eSuccessful exploitation allows unauthenticated attackers to modify critical store payment settings. This can lead to financial fraud by redirecting customer payments to attacker-controlled bank accounts and disrupting site availability by disabling payment gateways.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eUpdate the PGALL for WooCommerce plugin to version 5.5.18 or later immediately.\u003c/li\u003e\n\u003cli\u003eReview current payment gateway configurations for unauthorized changes to bank details or gateway status.\u003c/li\u003e\n\u003cli\u003eImplement Web Application Firewall (WAF) rules to inspect and filter POST requests to \u003ccode\u003eadmin-ajax.php\u003c/code\u003e containing \u003ccode\u003epgall-for-woocommerce-pafw_ajax_action\u003c/code\u003e from unauthenticated or suspicious IP addresses.\u003c/li\u003e\n\u003c/ul\u003e\n","date_modified":"2026-11-07T15:58:32Z","date_published":"2026-11-07T15:58:32Z","id":"https://feed.craftedsignal.io/briefs/2026-11-pgall-woocommerce-settings/","summary":"An unauthenticated settings change vulnerability in the PGALL for WooCommerce plugin allows attackers to manipulate payment gateway configurations via AJAX by harvesting nonces from public checkout pages.","title":"PGALL for WooCommerce: Unauthenticated settings change (CVE-2026-95597)","url":"https://feed.craftedsignal.io/briefs/2026-11-pgall-woocommerce-settings/"}],"language":"en","title":"CraftedSignal Threat Feed - PGALL for WooCommerce (\u003c= 5.5.17)","version":"https://jsonfeed.org/version/1.1"}