StoreGrowth permits unauthenticated changes to BOGO category messages
StoreGrowth through 2.1.0 registers bogo_category_msg_create as both wp_ajax_ and wp_ajax_nopriv_. The handler checks only the public ajd_protected nonce, accepts attacker-controlled data[id], data[message], data[categoryStatus] and optional data[editableId], and writes the result to spsg_bogo_general_settings with update_option(). An unauthenticated attacker can therefore create or modify BOGO category-message configuration. Version 2.1.1 removes the unauthenticated hook and adds an admin nonce and manage_options check.
- Component
- StoreGrowth – Upsell, BOGO, Quick View, Direct Checkout & Side Cart for WooCommerce
- Plugin slug
storegrowth-sales-booster- Affected
- <= 2.1.0
- Safe version
2.1.1- Published
- Jul 28, 2026
- Weakness
- CWE-862 — Missing Authorization
This CVE was published Jul 28, 2026 and is one of 3 known issues for this plugin.
Update, patch or deactivate.
Update StoreGrowth to 2.1.1 or later. Review BOGO category messages and general BOGO settings for unauthorized changes.
A safe version is available, so updating to that version or later is the preferred remediation. If an immediate update is not practical, consider a targeted application patch or temporarily restricting the affected functionality.
Deactivate only when warranted by your risk profile, or when advised by your hosting provider in the limited circumstances where the vulnerability cannot otherwise be mitigated. If you’re unsure which action is appropriate, contact Fused or your hosting provider for guidance.
Technical description
The Storegrowth Sales Booster plugin for WordPress is vulnerable to Missing Authorization in versions up to and including 2.1.0. This is due to a missing capability check on the bogo_category_msg_create() AJAX handler, which is registered for both authenticated (wp_ajax_) and unauthenticated (wp_ajax_nopriv_) users and only validates a nonce ('ajd_protected') that is emitted publicly via wp_localize_script() on every frontend page through front_scripts() . This makes it possible for unauthenticated attackers to modify the plugin's BOGO category-message configuration stored in the spsg_bogo_general_settings option by reading the nonce from any public page and POSTing attacker-controlled data to admin-ajax.
CVE / CNA vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N