CVE-2026-13110: Storegrowth Sales Booster Auth Bypass Flaw

CVE-2026-13110 Overview

CVE-2026-13110 is a Missing Authorization vulnerability [CWE-862] in the Storegrowth Sales Booster plugin for WordPress, affecting all versions up to and including 2.1.0. The flaw resides in the bogo_category_msg_create() AJAX handler, which lacks a capability check and is registered for both authenticated (wp_ajax_) and unauthenticated (wp_ajax_nopriv_) users. The handler only validates a nonce named ajd_protected, which the plugin exposes publicly via wp_localize_script() on every frontend page through front_scripts(). Unauthenticated attackers can read the nonce from any public page and POST attacker-controlled data to admin-ajax.php to modify the plugin's BOGO category-message configuration stored in the spsg_bogo_general_settings option.

Critical Impact
Unauthenticated attackers can modify plugin configuration data on affected WordPress sites without any user interaction.

Affected Products

Storegrowth Sales Booster plugin for WordPress
All versions up to and including 2.1.0
BOGO (Buy One Get One) module component

Discovery Timeline

2026-07-28 - CVE-2026-13110 published to NVD
2026-07-28 - Last updated in NVD database

Technical Details for CVE-2026-13110

Vulnerability Analysis

The vulnerability stems from an incomplete access control implementation in the plugin's BOGO module. The bogo_category_msg_create() AJAX handler is registered under both wp_ajax_ and wp_ajax_nopriv_ action hooks, exposing it to unauthenticated requests. The handler enforces only a nonce check on the ajd_protected token and omits a WordPress capability check such as current_user_can().

The intended nonce protection fails because the plugin distributes the ajd_protected nonce to every visitor. The front_scripts() function invokes wp_localize_script() on every frontend page, embedding the nonce directly into the page source for any unauthenticated visitor to harvest. Successful exploitation lets an attacker overwrite the spsg_bogo_general_settings option, altering promotional messaging shown to shoppers.

Root Cause

The root cause combines two design flaws. First, a privileged configuration-writing endpoint is registered as unauthenticated by the wp_ajax_nopriv_ hook. Second, the sole authorization control is a nonce that is published to unauthenticated users on every public page. Nonces in WordPress are designed to protect against Cross-Site Request Forgery, not to serve as authentication tokens.

Attack Vector

An attacker fetches any public frontend page on the target WordPress site and parses the HTML for the localized ajd_protected nonce value. The attacker then sends a POST request to /wp-admin/admin-ajax.php with action=bogo_category_msg_create, the harvested nonce, and attacker-controlled BOGO configuration fields. The server accepts the request and writes the payload into the spsg_bogo_general_settings option in the WordPress database. No authentication, no user interaction, and no privileged access are required.

Refer to the Wordfence Vulnerability Report and the WordPress Plugin Ajax File source for the vulnerable handler.

Detection Methods for CVE-2026-13110

Indicators of Compromise

POST requests to /wp-admin/admin-ajax.php containing action=bogo_category_msg_create originating from unauthenticated sessions or unfamiliar IP addresses.
Unexpected changes to the spsg_bogo_general_settings option in the wp_options table, especially modifications made outside of administrator sessions.
HTTP requests to public frontend pages followed shortly by AJAX POSTs reusing the same ajd_protected nonce from non-administrative sources.

Detection Strategies

Enable WordPress audit logging to capture option updates and correlate spsg_bogo_general_settings writes with the requesting user context.
Deploy a Web Application Firewall rule that blocks admin-ajax.php requests targeting bogo_category_msg_create when the session is unauthenticated.
Compare current values of the spsg_bogo_general_settings option against a known-good baseline to identify unauthorized modifications.

Monitoring Recommendations

Alert on high-frequency POSTs to admin-ajax.php with the vulnerable action name from a single source IP.
Monitor for anomalous storefront messaging content changes reported by shoppers or content-monitoring tools.
Track outbound links or scripts injected into BOGO promotional messages that could indicate follow-on abuse.

How to Mitigate CVE-2026-13110

Immediate Actions Required

Update the Storegrowth Sales Booster plugin to a version later than 2.1.0 once a patched release is available from the vendor.
If no patched version is available, deactivate and remove the Storegrowth Sales Booster plugin until a fix is released.
Audit the current value of the spsg_bogo_general_settings option and restore it from a trusted backup if tampering is suspected.

Patch Information

Review the vendor's plugin repository for the fix in the WordPress Plugin Changeset. A remediated release must add a capability check such as current_user_can('manage_options') to bogo_category_msg_create() and remove the wp_ajax_nopriv_ registration for privileged handlers.

Workarounds

Block unauthenticated POST requests to admin-ajax.php with action=bogo_category_msg_create at the WAF or reverse-proxy layer.
Restrict access to /wp-admin/admin-ajax.php for the vulnerable action to authenticated administrator sessions using server-level access rules.
Remove or comment out the wp_ajax_nopriv_bogo_category_msg_create action registration in the plugin source as a temporary hardening measure.

bash

# Example ModSecurity rule to block unauthenticated exploitation
SecRule REQUEST_URI "@endsWith /wp-admin/admin-ajax.php" \
    "chain,phase:2,deny,status:403,id:2026013110,\
    msg:'CVE-2026-13110 Storegrowth Sales Booster unauth config change'"
    SecRule ARGS:action "@streq bogo_category_msg_create" \
        "chain"
        SecRule &REQUEST_COOKIES:/wordpress_logged_in_/ "@eq 0"