Executive brief
The GSheet For Woo Importer plugin for WordPress, which allows store owners to import products from Google Sheets, contains a security flaw that allows low-level users to delete critical configuration data. An attacker with a basic subscriber account could reset the plugin's settings and delete its Google Sheets API token. This would disrupt the connection between the online store and Google Sheets, halting product imports and requiring manual reconfiguration by an administrator.
Technical details
The vulnerability is classified as a missing authorization check (CWE-862) within the process_ajax_restore_action() function of the GSheet For Woo Importer plugin. Due to the lack of proper capability validation, the function is accessible via AJAX to any authenticated user, including those with Subscriber-level permissions. An attacker can exploit this by sending a crafted request to trigger the restore action, which results in the deletion of the plugin's Google Sheets API token and other configuration options. This affects all versions of the plugin up to and including 2.3.1.
Affected products
- WordPress GSheet For Woo Importer Up to, and including, 2.3.1
Timeline
- 2026-05-21: disclosed
- 2026-05-21: advisory