CVE-2026-103080

Executive Summary

CVE-2026-103080 is an external control of assumed-immutable web parameter vulnerability (CWE-472) in the VillaTheme "Salevo" WordPress plugin (package slug woo-boost-sales), affecting all versions from inception through 1.3.0. Because Salevo is a WooCommerce sales-boosting plugin that exposes publicly reachable storefront functionality, the affected parameter can be supplied directly by an unauthenticated remote attacker (CVSS AV:N, PR:N, UI:N), enabling input data manipulation that the plugin treats as trustworthy server-side state. The impact is scored as limited integrity loss only (CVSS 5.3, C:N/I:L/A:N); no public exploit, Nuclei template, or proof-of-concept exists at time of writing, and no patch has been released.

Technical Analysis

CWE-472 describes the failure mode where an application accepts a web parameter from the client and relies on the assumption that the parameter is immutable or otherwise trustworthy. In WordPress/WooCommerce plugin code this class typically manifests when a value that the application implicitly expects to be set by its own server-side logic is instead read from attacker-controllable request data (query string, POST body, cookie, or header) without validation, server-side recomputation, or integrity binding. Because the malicious value is treated as legitimate, downstream decision logic is steered by the attacker rather than by the application.

Key characteristics for this instance:

• Attack surface: The woo-boost-sales plugin renders and processes public-facing storefront requests. The vulnerable code path is reachable without authentication, consistent with the CVSS vector (AV:N/AC:L/PR:N/UI:N).
• Mechanism: An assumed-immutable parameter is taken from the request instead of being derived server-side. The attacker alters the parameter to manipulate input that the plugin then processes as though it originated internally.
• Impact profile: The CNA/NVD scoring reflects integrity impact only (I:L) with no confidentiality (C:N) or availability (A:N) impact — consistent with state/data manipulation that changes logic outcomes rather than leaking secrets or causing denial of service.
• Complexity: AC:L indicates no special preconditions or race conditions are required to exercise the flaw.

No further implementation specifics (parameter names, endpoints, function names) are available in the supplied NVD description or CNA title. The analysis is therefore limited to the vulnerability class and the general WordPress/WooCommerce request-handling model; specific identifiers should not be assumed.

Exploitation Scenarios

No public PoC is available; the attack chain below is inferred from the vulnerability class (CWE-472) and the publicly reachable nature of the plugin. It is described at the class level and does not assert specific parameter names, endpoints, or code symbols, which are not provided in the source data.

1. Reconnaissance / target identification An attacker enumerates internet-facing WordPress sites and fingerprints the presence of the woo-boost-sales plugin (e.g., by detecting plugin asset paths under /wp-content/plugins/woo-boost-sales/ via HTTP response inspection, passive scanning, or search-engine/Shodan queries). Targets are WooCommerce storefronts with the Salevo plugin installed at version 1.3.0 or earlier.

2. Triggering the flaw class The attacker crafts a request to a publicly accessible plugin-handled action and introduces a parameter that the plugin assumes is immutable — that is, a value it expects to be controlled by its own server-side logic. Because the plugin reads the parameter value directly from the request, the attacker's supplied value is accepted as authoritative. No authentication or user interaction is required.

3. Payload / execution method (class level) The injected parameter value overwrites or substitutes the assumed-immutable input, causing the plugin to operate on attacker-supplied data in place of trusted data. This is input data manipulation: the request carries the altered value and the application acts on it as if internally generated. No public exploit code exists to demonstrate a concrete payload.

4. Post-exploitation impact The manipulated input can alter the plugin's sales-boost logic and the state or records it manages (integrity-only impact, I:L). There is no scored confidentiality or availability impact, so the practical effect is limited to data/state manipulation within the plugin's domain rather than credential theft or service disruption. Real-world severity depends on what downstream decisions consume the manipulated value.

Impact Assessment

• Business impact: Limited integrity loss affecting the WooCommerce "sales boost" functionality. Manipulated parameters can distort plugin-managed data or logic outcomes, which may affect promotional/sales data integrity and any downstream reporting that consumes it.
• Affected systems: WordPress sites running the VillaTheme Salevo (woo-boost-sales) plugin, versions through 1.3.0. Exposure requires the plugin to be installed and its public-facing functionality reachable.
• Blast radius: Constrained by the CVSS subscores — C:N (no confidentiality loss), I:L (low integrity impact), A:N (no availability loss). There is no evidence of lateral movement, privilege escalation, authentication bypass, or remote code execution in the available data.
• Exploitability: AV:N/AC:L/PR:N/UI:N — remotely reachable, low complexity, unauthenticated, no user interaction. This makes the flaw trivial to attempt once a vulnerable target is identified, even though impact is bounded.
• Overall severity: CVSS 5.3 (Medium). EPSS has not been scored by FIRST.org; no KEV listing; no known exploitation in the wild.

Detection Guidance

Detection logic below targets unauthenticated request tampering against the woo-boost-sales plugin. Because no parameter names or endpoint paths are published, rules focus on plugin-path access, anomalous parameter counts/unusual values on public-facing requests, and related web/WordPress telemetry. Tune field names and paths to the deployment.

Sigma Rule

title: Suspicious Request Tampering Against VillaTheme Salevo (woo-boost-sales)
id: 9f1c2a74-3b6e-4d2a-9f10-cve2026103080
status: experimental
description: Detects unauthenticated requests targeting the wooboost-sales plugin path that carry unexpected or malformed parameters consistent with CWE-472 assumed-immutable parameter manipulation (CVE-2026-103080).
references:
  - https://nvd.nist.gov/vuln/detail/CVE-2026-103080
author: valtersit.com
date: 2026/01/01
logsource:
  category: webserver
detection:
  selection_path:
    cs-uri-stem|contains:
      - '/wp-content/plugins/woo-boost-sales/'
      - 'woo-boost-sales'
  selection_params:
    cs-uri-query|contains:
      - '='   # any supplied parameters on plugin endpoints
  filter_legit:
    cs-uri-query|contains:
      - 'admin-ajax.php'
      - 'wp-json'
  condition: selection_path and selection_params
fields:
  - c-ip
  - cs-method
  - cs-uri-stem
  - cs-uri-query
  - cs-user-agent
falsepositives:
  - Legitimate storefront traffic to the plugin
  - Caching/CDN probes
level: medium

YARA Rule

rule CVE_2026_103080_Salevo_WooBoostSales
{
    meta:
        description = "Detects references to the vulnerable VillaTheme Salevo woo-boost-sales plugin (CVE-2026-103080) within web artifacts, plugin source, or logs"
        author = "valtersit.com"
        date = "2026-01-01"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2026-103080"
        cve = "CVE-2026-103080"

    strings:
        $slug  = "woo-boost-sales" ascii wide nocase
        $name  = "Salevo" ascii wide nocase
        $path1 = "/wp-content/plugins/woo-boost-sales/" ascii nocase
        $vendor = "VillaTheme" ascii wide nocase

    condition:
        uint32(0) == 0x04034b50 or
        ($slug or $path1) and ($name or $vendor)
}

Suricata IDS Rule

alert http any any -> any any (msg:"CVE-2026-103080 VillaTheme Salevo woo-boost-sales assumed-immutable parameter tampering attempt"; flow:established,to_server; http.uri; content:"/wp-content/plugins/woo-boost-sales/"; http.uri; content:"?"; http.method; content:"GET"; classtype:attempted-recon; reference:cve,2026-103080; reference:url,nvd.nist.gov/vuln/detail/CVE-2026-103080; sid:2026103080; rev:1;)

Elastic Detection

sequence by source.ip with maxspan=5m
  [ network where network.protocol == "http" and url.path like "%/wp-content/plugins/woo-boost-sales/%" ]
  [ network where network.protocol == "http" and url.path like "%/wp-content/plugins/woo-boost-sales/%" and url.query != null ]

Splunk SPL Query

index=web sourcetype=access_combined
| eval p=lower(uri_path), q=lower(uri_query)
| where (like(p,"%/wp-content/plugins/woo-boost-sales/%") OR like(p,"%woo-boost-sales%"))
| stats count min(_time) as firstTime max(_time) as lastTime dc(uri_query) as distinct_queries values(http_user_agent) as user_agents by src_ip, uri_path
| where count > 5 OR distinct_queries > 3
| convert ctime(firstTime) ctime(lastTime)
| sort - count

Wazuh OSSEC Rule

<group name="web,wordpress,cve-2026-103080,">
  <rule id="2026103080" level="8">
    <if_sid>31100,31101,31108</if_sid>
    <id>^2026103080$</id>
    <match>wp-content/plugins/woo-boost-sales</match>
    <description>Possible CVE-2026-103080 exploitation attempt: request referencing vulnerable VillaTheme Salevo woo-boost-sales plugin</description>
    <mitre>
      <id>T1190</id>
    </mitre>
    <group>cve_2026_103080,attack.initial_access,</group>
  </rule>
</group>

Mitigation & Patch Guidance

Patch confidence: 0/4 (UNPATCHED — no patch evidence from any tracked source). No vendor fix, advisory, or workaround has been published for CVE-2026-103080. All versions through 1.3.0 are affected.

1. Immediate mitigations (while unpatched)

   • If Salevo/woo-boost-sales is not actively required, deactivate and remove the plugin to eliminate the attack surface entirely.
   • If it must remain, restrict public request handling through a WAF/reverse proxy: deny or challenge requests where an assumed-immutable parameter appears client-supplied, and rate-limit unauthenticated requests to plugin-handled actions.
   • Apply least-privilege caching/proxy rules so that attacker-supplied values cannot be reused as trusted state; ensure no client-supplied value is cached as authoritative.
   • Monitor web logs for anomalous or duplicated parameters on woo-boost-sales paths (see Detection Guidance).
   • Continuously check the vendor channel for a fixed release and treat its absence as an open risk.

2. Patch/upgrade steps

   • No fixed version exists. Do not assume a patched build is available. Track the VillaTheme product page and NVD entry; when a release above 1.3.0 (or any advisory) appears, verify it addresses CWE-472 parameter handling before deploying.
   • Validate any future patch by confirming the parameter is validated or derived server-side rather than accepted from the request.

3. Long-term hardening

   • Adopt an inventory and versioning policy for third-party WordPress/WooCommerce plugins; alert on plugins that have no vendor maintenance or unresolved advisories.
   • Enforce the principle that security-relevant parameters are never trusted from the client — recompute or server-bind them.
   • Maintain WAF coverage and log detection for plugin-path anomalies across the storefront.
   • Reduce blast radius by segmenting WooCommerce hosts and restricting outbound egress where feasible.

References

• NVD — CVE-2026-103080: https://nvd.nist.gov/vuln/detail/CVE-2026-103080
• MITRE CWE-472 — External Control of Assumed-Immutable Web Parameter: https://cwe.mitre.org/data/definitions/472.html
• MITRE ATT&CK T1190 — Exploit Public-Facing Application: https://attack.mitre.org/techniques/T1190/
• FIRST EPSS (score not yet assigned for CVE-2026-103080): https://www.first.org/epss/
• CISA Known Exploited Vulnerabilities Catalog (CVE-2026-103080 NOT listed): https://www.cisa.gov/known-exploited-vulnerabilities-catalog

No public proof-of-concept, exploit code, Nuclei template, or evidence of in-the-wild campaigns or threat actor activity is associated with CVE-2026-103080 at the time of writing.