WPC Name Your Price CVE-2025-12115
HIGHSeverity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
Remote unauthenticated HTTP tampering (AV:N/AC:L/PR:N/UI:N); integrity limited to manipulating the attacker's own order price, so I:L; no confidentiality or availability impact.
Primary rating from Vendor (wordfence).
CVSS VectorVendor: wordfence
Lifecycle Timeline
4DescriptionCVE.org
The WPC Name Your Price for WooCommerce plugin for WordPress is vulnerable to unauthorized price alteration in all versions up to, and including, 2.1.9. This is due to the plugin not disabling the ability to name a custom price when it has been specifically disabled for a product. This makes it possible for unauthenticated attackers to purchase products at prices less than they should be able to.
AnalysisAI
Unauthorized price alteration in the WPC Name Your Price for WooCommerce plugin (versions up to and including 2.1.9) lets unauthenticated attackers submit a custom price for products where the Name Your Price option was deliberately disabled, allowing purchases below the intended amount. The plugin fails to enforce that per-product disable setting on the server side, so the client-side control can be bypassed with a crafted request. The supplied CVSS 3.1 score is 7.5, but the independent assessment rates integrity impact as Low (CVSS 3.1 base 5.3, Medium); exploitation is deployment-specific and no public exploit identified at time of analysis.
Technical ContextAI
The WPC Name Your Price for WooCommerce plugin adds a customer-defined pricing field to WooCommerce products. The flaw is CWE-602 (Client-Side Enforcement of Server-Side Security): when a store administrator disables the custom-price capability for a specific product, the plugin still processes a submitted custom price because it relies on the UI being unavailable rather than validating the product-level setting server-side during cart/checkout processing. No CPE strings were supplied in the input; the affected component is the WordPress plugin up to and including 2.1.9, running on a WooCommerce store. The WordPress Trac changeset in the references appears to be the upstream fix location, but no released patched version is identified in the supplied data.
Affected ProductsAI
Affected product: WPC Name Your Price for WooCommerce plugin for WordPress, versions up to and including 2.1.9. No CPE strings were supplied in the input. The vendor advisory is available via Wordfence Threat Intelligence at https://www.wordfence.com/threat-intel/vulnerabilities/id/f64bc3c4-da89-4470-8353-d490f8bec408?source=cve, and the referenced WordPress plugin Trac changeset is https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3386310%40wpc-name-your-price&new=3386310%40wpc-name-your-price&sfp_email=&sfph_mail=. Stores that do not have this plugin active, or that intentionally leave custom pricing enabled, are not exposed to the unauthorized-discount behavior.
RemediationAI
Upstream fix available via the referenced WordPress Trac changeset; released patched version not independently confirmed. Apply the upstream fix and update WPC Name Your Price for WooCommerce to a build containing that change, then confirm the fixed version with the vendor or Wordfence advisory before relying on a specific release number. If a patched build is not yet available, temporarily deactivate the plugin or remove products where the Name Your Price option is disabled from the public storefront; this removes legitimate custom-pricing functionality for all products as a side effect. Additional compensating controls include requiring login for checkout to prevent unauthenticated exploitation (trade-off: blocks guest purchases) and monitoring WooCommerce orders for abnormal prices on products with custom pricing disabled. Do not rely solely on hiding the price field; the root cause is missing server-side enforcement.
More in Woocommerce
View allThe WooCommerce plugin through 3.x for WordPress has a Directory Traversal Vulnerability via a /wp-content/plugins/wooco
The WooCommerce Help Scout WordPress plugin before 2.9.1 (https://woocommerce.com/products/woocommerce-help-scout/) allo
WooCommerce 7.1.0 contains a remote code execution vulnerability that allows attackers to execute arbitrary PHP code by
Ultimate WooCommerce Gift Cards 3.0.2 is affected by a file upload vulnerability in the Custom GiftCard Template that ca
Unauthenticated SQL injection in the ELEX WooCommerce Request a Quote WordPress plugin (all versions before 2.4.1) allow
Unauthenticated, network-reachable attackers can read the WooCommerce API consumer key and secret stored by the MgoSync
Unauth. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low atta
An issue was discovered in the NAB Transact extension 2.1.0 for the WooCommerce plugin for WordPress. Rated high severit
Privilege escalation in MultiVendorX WordPress plugin before 5.0.16 allows authenticated vendor-role users to grant admi
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Automattic WooComm
Unauthenticated information disclosure in the Geliver Akıllı Kargo Pazaryeri WordPress plugin (versions 3.0.0 through 3.
Authenticated attackers with only Subscriber-level access can mint wallet funds for themselves or drain a specific victi
Share
External POC / Exploit Code
Leaving vuln.today