Description

The Botiga Pro WordPress plugin before 1.6.5 does not perform any authorisation checks on one of its REST routes, allowing unauthenticated users to update arbitrary WordPress options with arbitrary values, which could lead to privilege escalation and a full site takeover. The same route also allows unauthenticated users to store arbitrary web scripts which are then executed on every page of the site's front end, as well as to move arbitrary posts to the trash.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "9.8",
  "pubDate": "2026-09-19T07:16:33.063Z",
  "pubdate": "2026-09-19T07:16:33.063Z",
  "executiveSummary": "The Botiga Pro WordPress plugin, specifically in versions prior to 1.6.5, contains a critical security vulnerability involving a lack of authorization checks on a REST API route. This flaw allows unauthenticated remote attackers to modify arbitrary WordPress options with attacker-supplied values.\nThe impact of this vulnerability is severe, potentially resulting in full site takeover via privilege escalation or the injection of persistent malicious scripts into the frontend. By manipulating options such as 'users_can_register' or 'default_role', an attacker can gain administrative access. Furthermore, the ability to store arbitrary scripts enables Stored Cross-Site Scripting (XSS), which executes within the context of visitors' sessions.\nThis vulnerability is highly critical due to the ease of exploitation, as it requires no prior authentication or administrative privileges. It exposes the entire WordPress environment to unauthorized configuration changes and potential persistent compromise of all front-end users.",
  "technicalDetails": "The vulnerability resides within the REST API implementation of the Botiga Pro plugin. The affected REST route fails to implement necessary permission callbacks (e.g., 'permission_callback' in the register_rest_route function), which are mandatory in WordPress to ensure that only authorized users can interact with sensitive plugin endpoints.\nThe root cause is a deficiency in input validation and access control verification within the plugin's REST controller. Because the endpoint does not verify the requester's capability or nonce, it accepts arbitrary POST or PUT requests from unauthenticated network entities.\nThe exploitation flow proceeds as follows: First, an attacker identifies the vulnerable REST route managed by the Botiga Pro plugin. Second, the attacker crafts an HTTP request targeting this endpoint, injecting unauthorized parameters to update specific entries in the 'wp_options' database table. By modifying options such as 'users_can_register' (setting it to 1) and 'default_role' (setting it to 'administrator'), an attacker can register a new account on the target site that inherits administrative privileges.\nAdditionally, the route allows for the arbitrary storage of content. An attacker can inject malicious JavaScript payloads into global site options that are rendered on every frontend page load. This results in persistent Stored Cross-Site Scripting (XSS) across the entire domain, facilitating session hijacking, credential theft, or the execution of unauthorized actions on behalf of authenticated administrators or users.\nBeyond configuration changes and XSS, the vulnerability also grants attackers the capability to disrupt site availability by manipulating post statuses, specifically by moving arbitrary posts to the trash via the same unauthenticated REST interface. This indicates a broad lack of oversight in the plugin's API design, impacting multiple critical functional areas.\nThe vulnerable component is the REST API handler within Botiga Pro versions below 1.6.5. Since the flaw is exposed via the WordPress REST API, it is accessible over the network to any remote actor capable of reaching the site's web server. No interaction with an authenticated session is required to initiate the attack, making this a high-risk vector for automated exploitation."
}