Flexible Quantity CVE-2026-106605

Requires the Flexible Quantity - Measurement Price Calculator for WooCommerce plugin (version through 2.3.22) to be installed and active on a WooCommerce store, with the quantity/measurement price-calculation input functionality exposed to requests. Per the CVSS vector (AV:N/AC:L/PR:N/UI:N), exploitation is remote and unauthenticated against default-reachable store endpoints with no user interaction. Exploitation is LIMITED to integrity impact only (I:L; C:N/A:N) - an attacker can manipulate submitted quantity/measurement input data but cannot read sensitive data, deny service, or execute code; actual business impact depends on how the store uses the manipulated values (e.g., pricing/order calculations).

This is a moderate-severity (CVSS 5.3) input-validation flaw (CWE-1284, Improper Validation of Specified Quantity) in the WP Desk Flexible Quantity plugin for WooCommerce. The CVSS vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N indicates network-reachable, low-complexity, unauthenticated exploitation with no user interaction, but with impact limited strictly to integrity (I:L) and no confidentiality or availability impact. No EPSS score, CISA KEV listing, SSVC decision data, or public POC was provided in the input, so exploitation likelihood cannot be quantified; based on signals present, this is 'no public exploit identified at time of analysis.' The realistic risk is low-to-moderate: although unauthenticated and remote, the maximum consequence is partial data manipulation (e.g., tampering with submitted quantity/measurement values), not code execution, data theft, or site takeover. Note a signal conflict: the input Tags include 'Information Disclosure,' yet the CVSS vector sets C:N (no confidentiality impact) and I:L - the vulnerability class (input/quantity manipulation) is an integrity issue, so the 'Information Disclosure' label appears inconsistent and should be verified with Patchstack. This is a 'high-exposure but low-impact' issue rather than an urgent priority.

A remote, unauthenticated attacker submits a crafted request to a WooCommerce store running the plugin, supplying a manipulated or out-of-bounds quantity/measurement value that the plugin fails to validate. This allows the attacker to tamper with input-driven calculations (such as quantity or price-affecting parameters) within the cart/order flow. No public exploit code was identified in the provided data, and the impact is limited to integrity (I:L) with no confidentiality or availability effect.