SellKit CVE-2026-94254

Requires the SellKit plugin (versions 2.3.5 up to but not including 2.8.0) active on a WooCommerce-style store whose checkout performs server-side total recalculation using a client-supplied product price. Exploitation is remote and unauthenticated (PR:N) against the normal public checkout flow, so no special configuration is needed beyond the store accepting guest orders for purchasable products. Limiting factors: only purchasable/in-stock products can be targeted, the store must be live and taking orders, and successful fraud depends on the merchant's payment gateway actually accepting the manipulated low total; sites updated to 2.8.0 or not running SellKit are unaffected.

This is a business-logic / missing-authorization flaw (CWE-862) rated CVSS 5.3 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N): network-reachable, low-complexity, no privileges and no user interaction, with impact limited to integrity (I:L) and no confidentiality or availability effect. The signals are largely consistent: AV:N/PR:N matches the description's 'unauthenticated attackers,' and I:L/C:N/A:N correctly reflects that the harm is data/price manipulation rather than data theft or outage. A publicly available exploit exists (WPScan), which raises practical accessibility, but EPSS is very low at 0.17% (5th percentile) and the CVE is NOT listed in CISA KEV, indicating no evidence of active or widespread exploitation at time of analysis. The low CVSS understates business risk for merchants: the flaw permits direct financial fraud (ordering goods at an attacker-chosen price), so for an operating e-commerce store this is a real, actionable priority despite the medium score, whereas for the broader population of WordPress sites not running this plugin it is not. Note: the input Tag 'Authentication Bypass' is inconsistent with CWE-862 and the description - this is missing price validation/authorization, not an authentication bypass; treat the tag with caution.

A guest shopper on a WooCommerce store running vulnerable SellKit crafts a checkout request that supplies its own product price, which the plugin trusts when recalculating order totals. The attacker completes a legitimate order for an expensive, purchasable product while paying a price of their choosing (e.g. near zero), resulting in financial loss to the merchant. A public exploit is available via WPScan, lowering the skill needed to reproduce the attack.