CVE-2026-15411

Name of the Vulnerable Software and Affected Versions StoreGrowth: Smart Sales Booster for WooCommerce | BOGO, Upsells, Direct Checkout, Quick View, Side Cart versions prior to 2.1.1

Description An authorization bypass exists because the plugin fails to properly verify if a user is authorized to perform specific actions. This allows unauthenticated attackers to overwrite the spsg popup products option with arbitrary data via the create popup AJAX action. The ajd protected nonce, intended as a security gate, is exposed to unauthenticated visitors on every frontend page through the BoGo module's wp localize script call, making it ineffective.

Recommendations Update to a version newer than 2.1.0.