Flexible Quantity CVE-2026-110364

The affected plugin (Flexible Quantity - Measurement Price Calculator for WooCommerce, versions up to and including 2.3.23) must be installed and active on a WordPress/WooCommerce site reachable over the network. Per AV:N/AC:L/PR:N/UI:N, no authentication, privileges, or user interaction are required, so default installations are reachable by unauthenticated remote actors. The practical limiting factor is impact scope, not access: the flaw yields only a LOW integrity effect (C:N/I:L/A:N), meaning an attacker can modify a constrained set of data rather than read sensitive data or disrupt the store. The exact feature/endpoint lacking the authorization check is not specified in the available data.

This is a moderate-severity (CVSS 5.3) Missing Authorization flaw (CWE-862) in the WP Desk Flexible Quantity plugin, reported by Patchstack. The CVSS vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N indicates a network-reachable, low-complexity attack requiring no privileges and no user interaction, but the impact is deliberately narrow: only a LOW integrity impact (I:L), with no confidentiality (C:N) and no availability (A:N) effect. This is the classic profile of a broken-access-control issue where an unauthenticated actor can reach an action that should be protected, but the action can only modify a limited subset of data rather than achieve full compromise. There is no EPSS score, no CISA KEV listing, and no public proof-of-concept provided in the input, so there is no evidence of active or imminent widespread exploitation. The signals are internally consistent - an easily reachable but low-impact bug - so this should be treated as a patch-in-normal-cycle item rather than an emergency. Note one metadata conflict: the 'Authentication Bypass' tag overstates the issue; CWE-862 and the referenced Patchstack advisory describe broken access control / missing authorization, not an authentication bypass.

An unauthenticated remote attacker sends a crafted HTTP request to a plugin endpoint (e.g. an AJAX or REST action) that lacks a proper capability or authorization check, allowing them to perform an action or alter plugin/order-related data they should not be able to touch. Because the CVSS vector is AV:N/AC:L/PR:N/UI:N, no login, no user interaction, and no special tooling is required. No public exploit code was identified in the provided data, so exploitation would currently require an attacker to independently identify the unprotected endpoint.