PGALL for WooCommerce (<= 5.5.17) - CraftedSignal Threat Feedhttps://feed.craftedsignal.io/products/pgall-for-woocommerce--5.5.17/Trending threats, MITRE ATT&CK coverage, and detection metadata. Fed continuously.Hugoenhello@craftedsignal.iohello@craftedsignal.ioSat, 07 Nov 2026 15:58:32 +0000https://feed.craftedsignal.io/favicon-32x32.pngCraftedSignal Threat Feedhttps://feed.craftedsignal.io/3232https://feed.craftedsignal.io/favicon.svgPGALL for WooCommerce: Unauthenticated settings change (CVE-2026-95597)https://feed.craftedsignal.io/briefs/2026-11-pgall-woocommerce-settings/Sat, 07 Nov 2026 15:58:32 +0000hello@craftedsignal.iohttps://feed.craftedsignal.io/briefs/2026-11-pgall-woocommerce-settings/An unauthenticated settings change vulnerability in the PGALL for WooCommerce plugin allows attackers to manipulate payment gateway configurations via AJAX by harvesting nonces from public checkout pages.The PGALL for WooCommerce WordPress plugin contains a vulnerability (CVE-2026-95597) that enables unauthenticated users to change plugin settings. The vulnerability exists within the AJAX handler pgall-for-woocommerce-pafw_ajax_action, which is exposed to logged-out users. The handler lacks proper capability checks or allow-listing for the methods it executes. Attackers can obtain the required nonce from the public WooCommerce checkout page and subsequently invoke methods such as save_account_details or process_admin_options to modify payment gateway configurations, including bank account details.

Attack Chain

  1. Attacker visits the public shop page to discover a product.
  2. Attacker adds the product to the cart to establish an anonymous WooCommerce session.
  3. Attacker navigates to the public checkout page to harvest the _pafw._wpnonce.
  4. Attacker crafts a POST request to /wp-admin/admin-ajax.php.
  5. Attacker provides the harvested nonce along with parameters payment_method=bacs and payment_action=save_account_details.
  6. The plugin handler executes the payment gateway method without authorization.
  7. The merchant's bank account details are overwritten with attacker-controlled data.

Impact

Successful exploitation allows unauthenticated attackers to modify critical store payment settings. This can lead to financial fraud by redirecting customer payments to attacker-controlled bank accounts and disrupting site availability by disabling payment gateways.

Recommendation

  • Update the PGALL for WooCommerce plugin to version 5.5.18 or later immediately.
  • Review current payment gateway configurations for unauthorized changes to bank details or gateway status.
  • Implement Web Application Firewall (WAF) rules to inspect and filter POST requests to admin-ajax.php containing pgall-for-woocommerce-pafw_ajax_action from unauthenticated or suspicious IP addresses.
]]>mediumadvisory