CVE WATCH / VULNERABILITY DETAIL
CVE-2026-120318
HIGHCVSS 7.2NVD feed
Published 2 November 2026 · tracked since 2 November 2026
Description
Product Gallery Slider & Additional Variation Images for WooCommerce 2.3.23 before 2.3.26 contains a missing authorization vulnerability in Codestar backup AJAX actions csf-export, csf-import and csf-reset. Shop Managers can read the csf_backup_nonce from the settings page and supply arbitrary optio
References
- NVD — National Vulnerability Database
- CVE.org record (MITRE)
- CISA Known Exploited Vulnerabilities catalog