CVE-2026-78137: StoreGrowth WordPress Auth Bypass Vulnerability

CVE-2026-78137 Overview

CVE-2026-78137 affects the StoreGrowth WordPress plugin in versions before 2.1.2. The plugin fails to validate a browser-supplied product price on two unauthenticated actions. When the Buy One Get One (BOGO) offer feature is enabled, unauthenticated attackers can add a product to the cart at an arbitrary, attacker-chosen price. The manipulated price carries through to the checkout total, allowing purchases at fractional cost.

Critical Impact
Unauthenticated attackers can purchase products at attacker-controlled prices, bypassing legitimate pricing on WooCommerce stores using vulnerable StoreGrowth installations.

Affected Products

StoreGrowth WordPress plugin versions before 2.1.2
WooCommerce storefronts with StoreGrowth BOGO offer feature enabled
WordPress sites running the vulnerable plugin with unauthenticated cart actions exposed

Discovery Timeline

2026-08-27 - CVE-2026-78137 published to NVD
2026-08-27 - Last updated in NVD database

Technical Details for CVE-2026-78137

Vulnerability Analysis

The vulnerability is a business logic flaw combined with improper input validation. StoreGrowth exposes two unauthenticated actions that accept a product price parameter directly from the client. The plugin trusts the browser-supplied value rather than resolving the authoritative price from the server-side WooCommerce product record.

When the BOGO offer feature is enabled, the attacker-supplied price is written into the cart item and propagated to the checkout total. An attacker can complete a purchase for pennies against products worth significantly more. The flaw requires no authentication and no user interaction beyond crafting a request to the vulnerable endpoint.

Root Cause

The root cause is missing server-side validation of a security-sensitive parameter. Product prices must be treated as trusted server data derived from the product ID, not as user input. StoreGrowth accepts the price field from an unauthenticated request context and persists it into the cart totals without cross-checking against the WooCommerce catalog.

Attack Vector

An unauthenticated remote attacker sends a crafted HTTP request to one of the two vulnerable StoreGrowth actions, supplying a product identifier alongside an arbitrarily low price value. The BOGO handler accepts the input, adds the item to the shopping session at the chosen price, and the checkout flow honors the manipulated total. The attacker then completes payment normally through WooCommerce.

Refer to the WPScan Vulnerability Report for the technical writeup.

Detection Methods for CVE-2026-78137

Indicators of Compromise

WooCommerce orders with line-item prices that do not match the current or historical catalog price for the same product SKU
Unauthenticated POST requests to StoreGrowth admin-ajax.php actions containing a price parameter
Completed orders with unusually low subtotals for high-value products, particularly involving BOGO promotions

Detection Strategies

Reconcile order line-item prices against the WooCommerce product catalog and flag any deviation outside of configured discounts or coupons
Inspect web server access logs for repeated unauthenticated calls to StoreGrowth action endpoints from a single source IP
Alert on cart or order creation events where the submitted price parameter is present in the request body

Monitoring Recommendations

Enable WooCommerce order auditing and forward order events to a centralized logging platform for price anomaly analysis
Monitor wp-admin/admin-ajax.php traffic for unauthenticated actions registered by the StoreGrowth plugin
Track chargeback and refund patterns for indicators of exploited underpriced transactions

How to Mitigate CVE-2026-78137

Immediate Actions Required

Update the StoreGrowth WordPress plugin to version 2.1.2 or later on all affected sites
Disable the BOGO offer feature until the update is applied if immediate patching is not possible
Audit recent WooCommerce orders for price manipulation and reverse fraudulent transactions

Patch Information

The vendor fixed the issue in StoreGrowth version 2.1.2. The patched release validates product prices server-side rather than trusting the browser-supplied value. Site operators should upgrade through the WordPress plugin dashboard or by installing the latest release manually. See the WPScan Vulnerability Report for advisory details.

Workarounds

Deactivate the StoreGrowth plugin entirely until version 2.1.2 or later can be installed
Turn off the BOGO offer feature within StoreGrowth to eliminate the vulnerable code path
Deploy a web application firewall rule that blocks unauthenticated requests to StoreGrowth AJAX actions carrying a client-supplied price parameter

bash

# Example WP-CLI commands to update or deactivate the plugin
wp plugin update storegrowth-sales-booster
wp plugin deactivate storegrowth-sales-booster