BugRater
Early access. The directory is still filling out, and every rating here comes from a researcher's reported experience.

Security releases

Codeixer

CVE-2026-120318: Product Gallery Slider & Additional Variation Images for WooCommerce 2.3.23 before 2.3.26 contains a missing authorization vulnerability in Codestar backup AJAX

CVE-2026-120318 Nov 2, 2026 Source: Vendor

Product Gallery Slider & Additional Variation Images for WooCommerce 2.3.23 before 2.3.26 contains a missing authorization vulnerability in Codestar backup AJAX actions csf-export, csf-import and csf-reset. Shop Managers can read the csf_backup_nonce from the settings page and supply arbitrary option names via the 'unique' parameter to read, overwrite or delete WordPress options, including modifying wp_user_roles to escalate to administrator.

Source of record The credited names below are quoted verbatim from the vendor's own advisory: https://nvd.nist.gov/vuln/detail/CVE-2026-120318
Are you credited here? Sign in to claim your line. It is yours immediately, with no review queue. The name the vendor printed stays next to your handle for anyone to check against the advisory above, and any member who thinks a claim is wrong can refute it.

Credited

1 line
All 1 CVEs 1 Additional recognition 0 Unclaimed only
Showing 1–1 of 1
CVE-2026-120318 BR2026-0000-041160 unclaimed
Credited as Youssef Alaoui Hichami