CVE-2026-120318
High
Description
Product Gallery Slider & Additional Variation Images for WooCommerce 2.3.23 before 2.3.26 contains a missing authorization vulnerability in Codestar backup AJAX actions csf-export, csf-import and csf-reset. Shop Managers can read the csf_backup_nonce from the settings page and supply arbitrary option names via the 'unique' parameter to read, overwrite or delete WordPress options, including modifying wp_user_roles to escalate to administrator.
SeverityHigh
CVSS7.2
Exploit probability—
ProductProduct Gallery Slider & Additional Variation Images for WooCommerce
PublishedNov 2, 2026
First seenNov 4, 2026
Weakness typeCWE-862Missing authorization
How to fix
Update
- Codeixer Product Gallery Slider & Additional Variation Images for WooCommerce2.3.26 or later
Patches
Vendor advisories
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| Codeixer Product Gallery Slider & Additional Variation Images for WooCommerce | 2.3.23 ≤ v < 2.3.26 | 2.3.26 |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
In the Intelligence 360 plan
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.