CVE-2026-120318

The record

Product Gallery Slider & Additional Variation Images for WooCommerce 2.3.23 before 2.3.26 contains a missing authorization vulnerability in Codestar backup AJAX actions csf-export, csf-import and csf-reset. Shop Managers can read the csf_backup_nonce from the settings page and supply arbitrary option names via the 'unique' parameter to read, overwrite or delete WordPress options, including modifying wp_user_roles to escalate to administrator.

Affected packages

Related vulnerabilities

• CVE-2026-121728 SourceHut meta.sr.ht 0.56.11 before 0.89.0 contains an authorization bypass vulnerability… CWE-862
• CVE-2026-121730 emailflare before commit cf31f33 contains a missing authorization vulnerability in POST… CWE-862
• CVE-2026-121729 emailflare before commit cf31f33 contains a missing authorization vulnerability in the… CWE-862
• CVE-2026-116663 Tanium addressed an improper access controls vulnerability in Enforce. CWE-862
• CVE-2026-121253 Missing authorization in DevTools in Google Chrome prior to 157.0.8103.38 allowed a… CWE-862
• CVE-2026-121251 Missing authorization in V8 in Google Chrome prior to 157.0.8103.38 allowed a remote… CWE-862
• CVE-2026-121194 Missing authorization in SiteIsolation in Google Chrome prior to 157.0.8103.38 allowed a… CWE-862
• CVE-2026-121199 Missing authorization in Chromoting in Google Chrome on on Mac prior to 157.0.8103.38… CWE-862