PT-2026-65444 · Wedevs · Storegrowth – Upsell

Wordfence Prism · CVE-2026-13110 · Published 2026-07-28 · Updated 2026-07-28

Mitre

CVSS v3.1

5.3

Medium

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N

The Storegrowth Sales Booster plugin for WordPress is vulnerable to Missing Authorization in versions up to and including 2.1.0. This is due to a missing capability check on the bogo category msg create() AJAX handler, which is registered for both authenticated (wp ajax ) and unauthenticated (wp ajax nopriv ) users and only validates a nonce ('ajd protected') that is emitted publicly via wp localize script() on every frontend page through front scripts() . This makes it possible for unauthenticated attackers to modify the plugin's BOGO category-message configuration stored in the spsg bogo general settings option by reading the nonce from any public page and POSTing attacker-controlled data to admin-ajax.

Fix

Missing Authorization

Weakness Enumeration

CWE-862

Related Identifiers

CVE-2026-13110

Affected Products

Storegrowth – Upsell

References · 6

• https://nvd.nist.gov/vuln/detail/CVE-2026-13110 · Security Note
• https://wordfence.com/threat-intel/vulnerabilities/id/b0d4c009-d969-49bb-a56b-a704e5f89a86?source=cve · Note
• https://plugins.trac.wordpress.org/changeset?reponame=&old=3619581%40storegrowth-sales-booster&new=3619581%40storegrowth-sales-booster · Note
• https://plugins.trac.wordpress.org/browser/storegrowth-sales-booster/tags/2.1.0/modules/bogo/includes/Ajax.php#L31 · Note
• https://plugins.trac.wordpress.org/browser/storegrowth-sales-booster/tags/2.1.0/modules/bogo/includes/Ajax.php#L223 · Note
• https://plugins.trac.wordpress.org/browser/storegrowth-sales-booster/tags/2.1.0/modules/bogo/includes/EnqueueScript.php#L177 · Note