WPC Name Your Price CVE-2026-16620

Exploitation requires that the target WordPress site runs WPC Name Your Price for WooCommerce at version 2.2.4 or earlier, and that at least one published WooCommerce product is actively configured in "Select" price mode with a merchant-defined price allowlist. No authentication is required - the attack is executable by any unauthenticated site visitor. No special network position, elevated privileges, or user interaction from store staff is needed. Exploitation is strictly limited to products using the "Select" mode; products in other pricing modes (standard fixed price or free-form Name Your Price) are not affected by this specific vector. The attacker must be able to reach the store's cart and checkout endpoints over standard HTTP/HTTPS, which is true of any public-facing storefront.

The CVSS 7.5 High score with vector AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N is directionally accurate: exploitation is network-accessible, requires no authentication or user interaction, and has zero complexity barrier. The High Integrity rating reflects that the submitted price - a core transactional data point - can be fully controlled by the attacker. Real-world risk is primarily financial: merchants may unknowingly fulfill orders at deeply discounted or near-zero prices, constituting revenue loss rather than a data breach or system compromise. EPSS data is not provided in the available intelligence. KEV status is not confirmed, and no public exploit code is referenced - suggesting no active widespread exploitation campaign at time of analysis. However, the trivial nature of the attack (standard HTTP parameter manipulation requiring no tooling) means the effective exploitation barrier is extremely low for any motivated buyer on a vulnerable store. The absence of POC documentation should not be interpreted as difficulty; this is a well-understood class of WooCommerce price manipulation. Merchants running Select-mode products on unpatched installations face meaningful transactional risk proportional to their order volume.

An attacker browses a vulnerable WooCommerce store, identifies a product configured in Select price mode (e.g., a donation or bundle product with options at $10, $25, and $50), then intercepts the add-to-cart POST request using a browser proxy and modifies the price parameter to $0.01. The server accepts the value without validating it against the configured allowlist, adds the item at $0.01, and the attacker completes checkout with a real payment method - resulting in a fulfilled order at a fraction of the intended price with no error raised by the plugin.