Flexible Quantity CVE-2026-116856

Requires the Flexible Quantity - Measurement Price Calculator for WooCommerce plugin to be installed and active at a version from n/a through 2.3.24 on a WooCommerce/WordPress site, reachable over the network. Per PR:N/UI:N/AC:L, no authentication, no user interaction, and no special timing are required, so default installations of the affected versions are exposed to anonymous requests. Exploitation is limited by impact scope: integrity-only, Low (I:L), with no confidentiality or availability effect, and the specific vulnerable action/feature that lacks the authorization check is not described in the available sources, so the exact prerequisite endpoint cannot be named from the provided data.

This is a medium-severity (CVSS 5.3) missing-authorization flaw whose signals point to moderate, not urgent, real-world risk. The vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N indicates remote, unauthenticated, low-complexity exploitation with no user interaction, which raises exposure - but the impact is narrow: integrity is only Low (I:L) with no confidentiality (C:N) and no availability (A:N) impact, consistent with CWE-862 broken access control permitting unauthorized changes to a limited subset of plugin data rather than full compromise. No EPSS score, no CISA KEV listing, and no confirmed public exploit were supplied, so there is no public-exploitation-probability signal and no evidence of active exploitation. The vuln.today decision label is 'this_month' (not act_now/emergency), aligning with the moderate profile. The only source is Patchstack (reporter and database entry). The main caveat: the description does not state which endpoint, action, or feature is affected, so the precise trigger and the scope of the 'limited' integrity impact cannot be confirmed from available data and should be verified against the Patchstack entry and vendor changelog.

A remote attacker with no account sends a crafted request directly to a plugin action that lacks a proper authorization (capability/nonce) check, causing an unauthorized change that an unprivileged or anonymous user should not be able to make. Given AV:N/AC:L/PR:N/UI:N, no authentication, user interaction, or special timing is needed, but impact is limited to integrity (I:L). No public exploit code was identified in the provided data; the Patchstack entry is an advisory reference, not verified working exploit code.