CVE-2026-15411 describes an authorization bypass vulnerability in the StoreGrowth: Smart Sales Booster for WooCommerce plugin (versions up to 2.1.0). The plugin does not adequately verify that a user is authorized to perform certain actions, specifically allowing unauthenticated attackers to overwrite the spsg_popup_products option with attacker-controlled data. The vulnerability arises because the 'ajd_protected' nonce, intended as a security token, is exposed to unauthenticated users on every frontend page via the BoGo module's wp_localize_script call, making it ineffective as an authorization control.

An unauthenticated attacker can overwrite plugin options with arbitrary data, potentially altering plugin behavior or causing unintended side effects. The vulnerability does not impact confidentiality or availability directly but allows integrity compromise of plugin settings. There is no indication of known exploits in the wild.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict access to the plugin or disable it if possible. Monitor vendor channels for updates and apply patches promptly once released.