CVE-2026-1929
Published: 25 February 2026
Description
The Advanced Woo Labels plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 2.37. This is due to the use of `call_user_func_array()` with user-controlled callback and parameters in the `get_select_option_values()` AJAX handler without…
more
an allowlist of permitted callbacks or a capability check. This makes it possible for authenticated attackers, with Contributor-level access and above, to execute arbitrary PHP functions and operating system commands on the server via the 'callback' parameter.
Mitigating Controls (NIST 800-53 r5)AI
Requires validation of the user-controlled 'callback' parameter in the get_select_option_values() AJAX handler to block arbitrary PHP function execution.
Enforces capability checks before processing the vulnerable AJAX handler, preventing authenticated attackers without sufficient privileges from exploiting it.
Ensures Contributor-level users do not have unnecessary privileges to access sensitive AJAX endpoints that could lead to RCE.
Security SummaryAI
CVE-2026-1929 is a remote code execution vulnerability in the Advanced Woo Labels plugin for WordPress, affecting all versions up to and including 2.37. The flaw arises from the improper use of the `call_user_func_array()` function with user-controlled callback and parameters within the `get_select_option_values()` AJAX handler. This handler lacks an allowlist of permitted callbacks or any capability checks, enabling the execution of arbitrary code.
Authenticated attackers possessing at least Contributor-level access can exploit this vulnerability remotely with low attack complexity and no user interaction required. By manipulating the 'callback' parameter in the AJAX request, they can execute arbitrary PHP functions and operating system commands on the affected server, resulting in high impacts to confidentiality, integrity, and availability (CVSS v3.1 score of 8.8; CWE-94).
References highlight the vulnerable code locations, including lines 136 and 146 in `includes/admin/class-awl-admin-ajax.php` across plugin tags 2.34 and 2.37, as well as the trunk version. The Wordfence threat intelligence advisory provides additional details on the issue (CVE source: https://www.wordfence.com/threat-intel/vulnerabilities/id/bbae9c33-becb-4c9d-917f-0d8fe8312d0c?source=cve).
Details
- CWE(s)
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
The vulnerability is a remote code execution flaw in a public-facing WordPress plugin's AJAX handler, allowing authenticated low-privilege attackers to execute arbitrary PHP code and OS commands, directly enabling T1190: Exploit Public-Facing Application.