CVE-2026-66466

HighCVSS 7.5

Published: 13/08/2026(UTC)Updated: 23/10/2026(UTC)Translated: 13/08/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.35%

27th percentile - higher than 27% of all known CVEs

Summary

Unauthenticated Broken Access Control in StoreGrowth: Smart Sales Booster for WooCommerce plugin versions up to 2.1.1. An attacker without authentication can access unauthorized functions.

Risk Assessment

Unauthorized access to store management functions, which may lead to settings manipulation, data leakage, or disruption of store operations.

Recommendation

Update the StoreGrowth plugin to the latest version that fixes the access control issue.

Other vulnerabilities in StoreGrowth: Smart Sales Booster for WooCommerce

CVE-2026-39750High
A vulnerability in the StoreGrowth: Smart Sales Booster for WooCommerce plugin up to version 2.0.6 allows an unauthenticated attacker to perform cross-site scripting (XSS).

Original NVD description (English source)

Unauthenticated Broken Access Control in StoreGrowth: Smart Sales Booster for WooCommerce | BOGO, Upsells, Direct Checkout, Quick View, Side Cart <= 2.1.1 versions.

Vulnerability data from NVD (NIST) · CISA KEV · EPSS