Description

External Control of Assumed-Immutable Web Parameter vulnerability in VillaTheme Salevo woo-boost-sales allows Input Data Manipulation.This issue affects Salevo: from n/a through 1.3.0.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "5.3",
  "pubDate": "2026-10-12T18:17:20.627Z",
  "pubdate": "2026-10-12T18:17:20.627Z",
  "executiveSummary": "The Salevo woo-boost-sales plugin is affected by an External Control of Assumed-Immutable Web Parameter vulnerability.\nThis security flaw allows an unauthenticated or authenticated attacker to perform unauthorized input data manipulation by modifying parameters that the application assumes to be immutable.\nThe vulnerability resides in versions from n/a through 1.3.0 of the plugin.\nBy manipulating these parameters, an attacker may be able to alter plugin behavior, bypass intended business logic, or potentially influence data processing within the WordPress environment.\nThe primary risk involves the compromise of data integrity and potential unauthorized functional manipulation of the Salevo woo-boost-sales features.\nSuccessful exploitation requires the attacker to intercept or craft malicious HTTP requests to target the vulnerable parameter handling mechanism.",
  "technicalDetails": "The vulnerability, classified as External Control of Assumed-Immutable Web Parameter, occurs when the Salevo woo-boost-sales plugin fails to properly validate or sanitize user-supplied input for parameters that the developers mistakenly assumed could not be altered by a client.\nIn web application security, an 'assumed-immutable' parameter is a value (often passed via GET, POST, or cookies) that the server-side code treats as trusted configuration or internal state rather than user input. Because the application logic does not anticipate modification of these parameters, it fails to apply rigorous server-side validation, allowing an attacker to inject arbitrary values.\nThe attack flow begins when an attacker identifies the specific web parameters used by the plugin to control its 'woo-boost-sales' logic. The attacker can then utilize tools such as an intercepting proxy (e.g., Burp Suite) to capture requests sent to the server. By modifying these parameters in transit, the attacker forces the application to process data inconsistent with the intended plugin state.\nBecause the vulnerable component relies on these parameters to dictate execution flow, the manipulation can lead to unauthorized modifications of sales data, promotional settings, or other plugin-specific configurations. The technical root cause is a failure in the trust boundary, where the application trusts input from the client-side without re-verifying the integrity of the data against server-side session or database state.\nThis vulnerability does not strictly require high-level administrative privileges depending on the specific endpoint exposed, meaning an attacker with low-level or no authentication may be able to manipulate the input if the vulnerable endpoint is exposed to the public internet.\nThe scope of impact is limited to the functionalities managed by the plugin, but post-exploitation may include the alteration of sales conversion tracking, display of unauthorized sales data, or other logical inconsistencies that could be leveraged for further attacks against the underlying WordPress installation."
}