CVE-2026-15411: WooCommerce StoreGrowth Auth Bypass Flaw

CVE-2026-15411 Overview

CVE-2026-15411 affects the StoreGrowth: Smart Sales Booster for WooCommerce plugin for WordPress, which adds BOGO, upsells, direct checkout, quick view, and side cart features. All versions up to and including 2.1.0 contain a missing authorization flaw [CWE-862]. The plugin fails to properly verify that a user is authorized to perform an action before writing to the spsg_popup_products option. Unauthenticated attackers can overwrite this option with arbitrary data. The ajd_protected nonce intended as the gate is exposed to unauthenticated visitors on every frontend page through the BoGo module's wp_localize_script call, so it does not function as an authorization barrier.

Critical Impact
Unauthenticated attackers can overwrite the spsg_popup_products WordPress option with arbitrary attacker-controlled data, corrupting sales-pop configuration on affected WooCommerce stores.

Affected Products

StoreGrowth: Smart Sales Booster for WooCommerce plugin for WordPress
All versions up to and including 2.1.0
BoGo and Sales Pop modules of the plugin

Discovery Timeline

2026-07-28 - CVE-2026-15411 published to NVD
2026-07-28 - Last updated in NVD database

Technical Details for CVE-2026-15411

Vulnerability Analysis

The flaw is a missing authorization issue in the Sales Pop module's AJAX handler. The handler updates the spsg_popup_products WordPress option based on request input without confirming that the caller has an appropriate capability. The only protection in front of the update is a nonce check against ajd_protected. That nonce is generated server-side and shipped to any visitor because the BoGo module registers it through wp_localize_script on every public-facing page load. As a result, an unauthenticated attacker can scrape the nonce from any frontend response and replay it against the AJAX endpoint. Because the impact is limited to overwriting a plugin option, the direct effect is integrity loss for stored popup product configuration rather than data disclosure or code execution.

Root Cause

The root cause is a conflation of nonce verification with authorization. Nonces prevent cross-site request forgery, but they do not establish that the caller holds a required WordPress capability. The AJAX handler in modules/sales-pop/includes/Ajax.php lacks a current_user_can() or equivalent capability check before persisting user-supplied data into the option.

Attack Vector

An attacker requests any public page of a site running the vulnerable plugin and extracts the localized ajd_protected nonce from the BoGo module's inline script. The attacker then issues a WordPress AJAX POST request to the vulnerable Sales Pop action, supplying the harvested nonce and an arbitrary payload for the popup products data. The server accepts the request and calls update_option('spsg_popup_products', ...) with the attacker's payload, replacing the legitimate configuration.

See the Wordfence Vulnerability Analysis and the plugin source references for the EnqueueScript nonce localization and the Sales Pop AJAX handler for the exact code paths.

Detection Methods for CVE-2026-15411

Indicators of Compromise

Unexpected changes to the spsg_popup_products row in the WordPress wp_options table, including malformed serialized data or attacker-controlled product entries.
WooCommerce storefront popups displaying products, links, or content that were not configured by site administrators.
Web server access logs showing unauthenticated POST requests to /wp-admin/admin-ajax.php with the Sales Pop action referenced in modules/sales-pop/includes/Ajax.php.

Detection Strategies

Audit the current value of spsg_popup_products against a known-good backup and alert on drift.
Correlate AJAX requests targeting the Sales Pop action with unauthenticated sessions (no wordpress_logged_in_* cookie) in web logs.
Baseline the frequency of writes to wp_options rows owned by the plugin and flag anomalous update volume.

Monitoring Recommendations

Enable file integrity monitoring for the wp-content/plugins/storegrowth-sales-booster/ directory to detect tampering.
Forward WordPress and web server logs to a centralized log platform and retain them long enough to investigate suspicious option changes.
Add a WAF rule that inspects admin-ajax.php requests for the vulnerable action name when no authenticated session cookie is present.

How to Mitigate CVE-2026-15411

Immediate Actions Required

Update the StoreGrowth Sales Booster plugin to a version later than 2.1.0 that includes the fix referenced in the WordPress plugin changeset.
Restore the spsg_popup_products option from a known-good backup if tampering is suspected.
Review WooCommerce storefronts for unauthorized popup content and remove attacker-supplied entries.

Patch Information

The vendor addressed the missing authorization in a plugin update tracked in the WordPress.org plugin repository changeset 3619581. Administrators should upgrade to the latest available release of storegrowth-sales-booster through the WordPress plugin updater. Verify the installed version under Plugins > Installed Plugins after upgrading.

Workarounds

Deactivate and uninstall the StoreGrowth Sales Booster plugin until a patched version can be applied if immediate upgrade is not possible.
Block unauthenticated POST requests to admin-ajax.php for the Sales Pop action at the WAF or reverse proxy layer.
Restrict access to /wp-admin/admin-ajax.php from untrusted networks where the store does not require public AJAX interaction.

bash

# Example nginx rule to block unauthenticated calls to the vulnerable AJAX action
location = /wp-admin/admin-ajax.php {
    if ($request_method = POST) {
        if ($arg_action ~* "spsg_|sales_pop") {
            if ($http_cookie !~* "wordpress_logged_in_") {
                return 403;
            }
        }
    }
    include fastcgi_params;
    fastcgi_pass php_upstream;
}