CVE-2026-103080— WordPress Salevo plugin <= 1.3.0 - Broken Access Control vulnerability
Quick assessment
Affected
VillaTheme Salevo
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.
在 VillaTheme Salevo woo-boost-sales 插件中存在“对假定不可变的 Web 参数外部控制”漏洞，该漏洞允许攻击者操纵输入数据。此问题影响 Salevo 插件：从 1.3.0 之前的所有版本（包括 n/a 至 1.3.0）。
Possible ATT&CK Techniques 2 AI
T1133 · External Remote Services T1190 · Exploit Public-Facing ApplicationAffected Version Matrix 1
| Vendor | Product | Version Range | Status |
|---|---|---|---|
| VillaTheme | Salevo | ≤ 1.3.0 |
affected |
Get alerts for future matching vulnerabilities
Log in to subscribe
I. Basic Information for CVE-2026-103080
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
WordPress Salevo plugin <= 1.3.0 - Broken Access Control vulnerability
Source: CVE Program / CVE List V5
Vulnerability Description
External Control of Assumed-Immutable Web Parameter vulnerability in VillaTheme Salevo woo-boost-sales allows Input Data Manipulation.This issue affects Salevo: from n/a through 1.3.0.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
Source: CVE Program / CVE List V5
Vulnerability Type
对假设不可变Web参数的外部可控制
Source: CVE Program / CVE List V5
Affected Products
| Vendor | Product | Affected Versions | CPE | Subscribe |
|---|---|---|---|---|
| VillaTheme | Salevo | 0 ~ 1.3.0 | - |
|
II. Public POCs for CVE-2026-103080
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POC
Premium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2026-103080
请登录查看更多情报信息。
Other References for CVE-2026-103080 (1)
IV. Related Vulnerabilities
Same vendor: VillaTheme
-
CVE-2026-103356
WordPress TMDS plugin <= 1.0.15 - Broken Access Control vuln -
CVE-2026-103685
WordPress ALD – Dropshipping and Fulfillment for AliExpress -
CVE-2026-104398
WordPress AFFI – Affiliate Marketing for WooCommerce plugin -
CVE-2026-103071
WordPress Thank You Page Customizer for WooCommerce plugin < -
CVE-2026-103357
WordPress GIFT4U plugin <= 1.1.3 - Broken Access Control vul
Same weakness: CWE-472
-
CVE-2026-107636
pH7Builder before 18.5.1 Payment Bypass via Payment Module M -
CVE-2026-107363
OpenStack Zaqar 19.1.0前越权漏洞 -
CVE-2026-82189
Joomla Extension - j2commerce.com - Any order can be marked -
CVE-2026-84762
WordPress WP EasyPay plugin <= 4.5.3 - Bypass Vulnerability -
CVE-2026-77999
Joomla Extension - j2commerce.com - Unauthenticated PayPal c
V. Comments for CVE-2026-103080
No comments yet