CVE-2026-13110

The Storegrowth Sales Booster plugin for WordPress is vulnerable to Missing Authorization in versions up to and including 2.1.0. This is due to a missing capability check on the bogo_category_msg_create() AJAX handler, which is registered for both authenticated (wp_ajax_) and unauthenticated (wp_ajax_nopriv_) users and only validates a nonce ('ajd_protected') that is emitted publicly via wp_localize_script() on every frontend page through front_scripts() . This makes it possible for unauthenticated attackers to modify the plugin's BOGO category-message configuration stored in the spsg_bogo_general_settings option by reading the nonce from any public page and POSTing attacker-controlled data to admin-ajax.

• CWE-862

• https://plugins.trac.wordpress.org/browser/storegrowth-sales-booster/tags/2.1.0/modules/bogo/includes/Ajax.php#L223
• https://plugins.trac.wordpress.org/browser/storegrowth-sales-booster/tags/2.1.0/modules/bogo/includes/Ajax.php#L31
• https://plugins.trac.wordpress.org/browser/storegrowth-sales-booster/tags/2.1.0/modules/bogo/includes/EnqueueScript.php#L177
• https://plugins.trac.wordpress.org/changeset?reponame=&old=3619581%40storegrowth-sales-booster&new=3619581%40storegrowth-sales-booster
• https://www.wordfence.com/threat-intel/vulnerabilities/id/b0d4c009-d969-49bb-a56b-a704e5f89a86?source=cve

Published

Jul 28, 2026

Last Modified

Jul 28, 2026

Status

Deferred

• Uncovering a hidden BOLA in Appsmith's snapshot logicStrix autonomously discovered a BOLA/IDOR vulnerability in Appsmith's snapshot deletion path.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-13084A null pointer dereference vulnerability in WatchGuard Firew…8.7
• CVE-2026-13089OIDC::Lite versions through 0.12.1 for Perl allow ID Token s…7.5
• CVE-2026-1310The Simple calendar for Elementor plugin for WordPress is vu…5.3
• CVE-2026-13103A potential path traversal vulnerability was reported in Len…7.3
• CVE-2026-13104A potential vulnerability was reported in Lenovo App Store, …7.3
• CVE-2026-1311The Worry Proof Backup plugin for WordPress is vulnerable to…8.8
• CVE-2026-13113GitLab has remediated an issue in GitLab EE affecting all ve…5.3
• CVE-2026-13114The Motors – Car Dealership & Classified Listings Plugin plu…7.2
• CVE-2026-13116The PDF Invoices & Packing Slips for WooCommerce plugin for …4.3
• CVE-2026-13117An incomplete guard in OpenVPN 2.6.0 through 2.6.20 and 2.7_…8.1
• CVE-2026-13119The Registrations For The Events Calendar plugin for WordPre…6.5
• CVE-2026-1312An issue was discovered in 6.0 before 6.0.2, 5.2 before 5.2.…5.4