CVE-2026-13110 describes a missing authorization vulnerability (CWE-862) in the StoreGrowth – Upsell, BOGO, Quick View, Direct Checkout & Side Cart for WooCommerce WordPress plugin. The issue arises from the bogo_category_msg_create() AJAX handler being registered for both authenticated and unauthenticated users without proper capability checks. The handler relies solely on a nonce ('ajd_protected') that is publicly available on frontend pages, enabling attackers without authentication to alter the plugin's BOGO category-message settings stored in the spsg_bogo_general_settings option by submitting attacker-controlled data via admin-ajax.php.

An unauthenticated attacker can modify the BOGO category-message configuration of the plugin, potentially altering promotional messages or settings. This impacts the integrity of the plugin's configuration but does not affect confidentiality or availability. The CVSS 3.1 base score is 5.3 (medium severity), reflecting network attack vector, low attack complexity, no privileges required, no user interaction, unchanged scope, no confidentiality impact, limited integrity impact, and no availability impact.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict access to the affected AJAX handler if possible or disable the plugin if the risk is unacceptable. Monitor vendor communications for updates and apply patches promptly once released.