External Control of Assumed-Immutable Web Parameter vulnerability in VillaTheme Salevo woo-boost-sales allows Input Data Manipulation.This issue… (CVE-2026-103080)

This vulnerability (CVE-2026-103080) in VillaTheme Salevo woo-boost-sales plugin allows an attacker to manipulate input data by externally controlling a web parameter that the application assumes to be immutable. This can lead to integrity issues within the affected application. The vulnerability affects versions up to and including 1.3.0. The CVSS 3.1 base score is 5.3, reflecting network attack vector, low attack complexity, no privileges required, no user interaction, unchanged scope, no confidentiality or availability impact, but integrity impact is low.

The vulnerability allows an attacker to manipulate input data, potentially causing unauthorized changes or actions within the application. There is no impact on confidentiality or availability. The integrity impact is low, meaning the attacker can alter data but not compromise sensitive information or disrupt service.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. No official fix or patch information is available at this time. Users should monitor vendor communications for updates and consider restricting access or input validation as interim measures.