WordPress Plugin Vulnerabilities

StoreGrowth: Smart Sales Booster for WooCommerce < 2.1.2 - Unauthenticated Arbitrary Price Manipulation via BOGO Add-to-Cart

Description

The plugin does not validate a browser-supplied product price on two of its unauthenticated actions, allowing unauthenticated attackers to add a product to the cart at an arbitrary, attacker-chosen price that carries through to the checkout total when the BOGO offer feature is enabled.

Proof of Concept

Affects Plugins

Plugin icon
storegrowth-sales-booster
Fixed in 2.1.2

References

CVE
CVE-2026-78137

Classification

Type
NO AUTHORISATION
OWASP top 10
A5: Broken Access Control
CWE
CWE-862
CVSS
7.5 (high)

Miscellaneous

Original Researcher
Shikhali Jamalzade
Submitter
Shikhali Jamalzade
Submitter website
https://alisalive.medium.com
Submitter twitter
0xAlisAlive
Verified
Yes
WPVDB ID
15d1a53b-c5f3-4509-9889-ddc48507df35

Timeline

Publicly Published
2026-08-25 (about 3 days ago)
Added
2026-08-25 (about 2 days ago)
Last Updated
2026-08-25 (about 2 days ago)

Other

Published
Title
Published
2025-07-04
Title
Frontend File Manager <= 23.2 - Missing Authorization to Authenticated (Subscriber+) Content Injection
Published
2025-11-11
Title
Alt Text Generator AI – Auto Generate & Bulk Update Alt Texts For Images < 1.8.4 - Missing Authorization to Authenticated (Subscriber+) API Key Deletion
Published
2023-07-10
Title
Buy Me a Coffee – Button and Widget Plugin < 3.8 - Subscriber+ Unauthorized Data Modification
Published
2026-04-29
Title
Contest Gallery – Upload & Vote Photos, Media, Sell with PayPal & Stripe < 29.0.0 - Missing Authorization
Published
2025-07-08
Title
WCFM – Frontend Manager for WooCommerce along with Bookings Subscription Listings Compatible < 6.7.17 - Missing Authorization to Unauthenticated Plugin Settings Modification