Monthly
Payment amount tampering in Balbooa Forms (Joomla extension) versions prior to 2.4.3.2 allows any unauthenticated visitor to purchase priced items for an attacker-controlled amount - including $0.01 - by submitting a crafted value directly to the stripeCharges or payAuthorize payment endpoints. The server forwards this client-supplied total to the payment gateway without recomputing it from configured product prices, and neither endpoint enforces authentication or CSRF checks, making exploitation trivial with a single HTTP request. No public exploit has been identified at time of analysis, but the attack requires zero prerequisites beyond a published payment-enabled form.
Authenticated customers on WooCommerce stores running Wallet System for WooCommerce before 2.7.10 can complete purchases for free by submitting arbitrarily inflated wallet deduction amounts during checkout that the plugin accepts without verifying against the customer's actual stored balance. This business logic flaw enables systematic payment fraud - any registered shopper can zero out an order total and receive goods or services without paying the merchant. A publicly available proof-of-concept exists per WPScan, making this trivially exploitable by any site visitor who can register an account, and patching should be treated as urgent.
Price allowlist bypass in WPC Name Your Price for WooCommerce (WordPress plugin before 2.2.5) permits unauthenticated visitors to submit arbitrary below-minimum prices for products configured in "Select" mode, resulting in real completed orders at merchant-disadvantageous amounts and direct revenue loss. The flaw is a distinct business logic failure left unaddressed by the CVE-2025-12115 patch (v2.2.0), which only corrected a related but separate vector involving products with Name Your Price disabled. No public exploit identified at time of analysis, though the attack requires no authentication and is trivially executable against any vulnerable storefront with a Select-mode product.
Price manipulation via client-supplied ticket values in Event Booking Manager for WooCommerce (Pro) before 5.0.3 allows unauthenticated attackers to book paid event tickets at arbitrary prices, including free. The plugin's native (non-WooCommerce) checkout flow trusts the per-ticket price submitted by the client rather than re-deriving it from the server-side event configuration - a classic business logic failure. No public exploit or CISA KEV listing has been identified at time of analysis, but the attack requires no authentication and no special preconditions beyond the affected checkout mode being in use.
Price manipulation in the CoCart WordPress plugin before 4.9.0 allows unauthenticated remote attackers to purchase WooCommerce products at arbitrarily low prices by supplying a manipulated price value through the plugin's public REST API cart endpoint. The server accepts the attacker-controlled price without comparing it to the canonical product price, enabling completed orders at near-zero cost and direct financial loss to store operators. No public exploit code or CISA KEV listing has been identified, but the CVSS:3.1/AV:N/AC:L/PR:N/UI:N vector indicates this is trivially exploitable against any default-configured CoCart deployment.
Price manipulation in the Persian Elementor WordPress plugin (all versions up to and including 2.8.1) allows unauthenticated remote attackers to submit arbitrary payment amounts to the ZarinPal payment gateway by tampering with the client-supplied 'amount' POST parameter, bypassing the price configured in the Elementor widget. The root cause is the absence of server-side reconciliation between the submitted payment figure and the widget's defined price - whatever the client sends is forwarded directly to ZarinPal. No public exploit code has been identified and the CVE is not listed in the CISA KEV catalog, though exploitation requires zero authentication and only trivial HTTP parameter manipulation.
Information disclosure in ABIS Technology's AVESİS software allows unauthenticated remote attackers to bypass ACLs and access restricted functionality via manipulated web parameters. Affected versions prior to build 202606251646. Exploitation likelihood is low (EPSS 0.2%), no active exploitation is known, and a vendor patch is available.
Payment and calculation total tampering in the Ninja Forms WordPress plugin (versions 3.14.8 and prior) allows unauthenticated attackers to submit crafted values that match no configured option in ListSelect or ListRadio fields, causing the get_calc_value() method to fail open and return attacker-supplied numbers. This lets an attacker rewrite form calculation results and payment amounts - including setting order totals to zero - bypassing admin-defined pricing logic. Reported by VulnCheck with a vendor patch available; no public exploit identified at time of analysis, and this is not listed in CISA KEV.
Skillable's hosted SCORM lab launch endpoint at scorm.skillable.com enforces per-user lab allocation limits against a client-supplied userId query parameter that is never validated against the authenticated SCORM session token, enabling any enrolled learner to bypass rate limits, provision concurrent cloud VM lab instances at the course provider's expense, and exhaust another enrolled user's lab or exam allocation to deny them access. The vulnerability (CWE-639) was confirmed against the reporter's own account and a consenting fellow student on 2026-05-03; the vendor subsequently acknowledged in a private customer advisory that exam allocations and another learner's active session details are also reachable via the same mechanism. No fix is planned for the SCORM launch path; the vendor characterises the weakness as an inherent SCORM limitation and recommends migration to API or LTI 1.3 integrations. No public exploit code has been released, but the attack technique is trivially reproducible by any enrolled student with a proxy.
Ghost CMS versions 6.27.0 through 6.43.x permit unauthenticated attackers to manipulate donation checkout metadata, enabling acquisition of full paid gift memberships for a minimal payment. The flaw, classified as CWE-472 (External Control of Assumed-Immutable Web Parameter), stems from the server trusting client-controlled parameters in the public-facing checkout flow that should be server-authoritative. No active exploitation is confirmed (not in CISA KEV) and no public exploit has been identified; the vendor released a fix in version 6.44.0.
Payment amount tampering in Balbooa Forms (Joomla extension) versions prior to 2.4.3.2 allows any unauthenticated visitor to purchase priced items for an attacker-controlled amount - including $0.01 - by submitting a crafted value directly to the stripeCharges or payAuthorize payment endpoints. The server forwards this client-supplied total to the payment gateway without recomputing it from configured product prices, and neither endpoint enforces authentication or CSRF checks, making exploitation trivial with a single HTTP request. No public exploit has been identified at time of analysis, but the attack requires zero prerequisites beyond a published payment-enabled form.
Authenticated customers on WooCommerce stores running Wallet System for WooCommerce before 2.7.10 can complete purchases for free by submitting arbitrarily inflated wallet deduction amounts during checkout that the plugin accepts without verifying against the customer's actual stored balance. This business logic flaw enables systematic payment fraud - any registered shopper can zero out an order total and receive goods or services without paying the merchant. A publicly available proof-of-concept exists per WPScan, making this trivially exploitable by any site visitor who can register an account, and patching should be treated as urgent.
Price allowlist bypass in WPC Name Your Price for WooCommerce (WordPress plugin before 2.2.5) permits unauthenticated visitors to submit arbitrary below-minimum prices for products configured in "Select" mode, resulting in real completed orders at merchant-disadvantageous amounts and direct revenue loss. The flaw is a distinct business logic failure left unaddressed by the CVE-2025-12115 patch (v2.2.0), which only corrected a related but separate vector involving products with Name Your Price disabled. No public exploit identified at time of analysis, though the attack requires no authentication and is trivially executable against any vulnerable storefront with a Select-mode product.
Price manipulation via client-supplied ticket values in Event Booking Manager for WooCommerce (Pro) before 5.0.3 allows unauthenticated attackers to book paid event tickets at arbitrary prices, including free. The plugin's native (non-WooCommerce) checkout flow trusts the per-ticket price submitted by the client rather than re-deriving it from the server-side event configuration - a classic business logic failure. No public exploit or CISA KEV listing has been identified at time of analysis, but the attack requires no authentication and no special preconditions beyond the affected checkout mode being in use.
Price manipulation in the CoCart WordPress plugin before 4.9.0 allows unauthenticated remote attackers to purchase WooCommerce products at arbitrarily low prices by supplying a manipulated price value through the plugin's public REST API cart endpoint. The server accepts the attacker-controlled price without comparing it to the canonical product price, enabling completed orders at near-zero cost and direct financial loss to store operators. No public exploit code or CISA KEV listing has been identified, but the CVSS:3.1/AV:N/AC:L/PR:N/UI:N vector indicates this is trivially exploitable against any default-configured CoCart deployment.
Price manipulation in the Persian Elementor WordPress plugin (all versions up to and including 2.8.1) allows unauthenticated remote attackers to submit arbitrary payment amounts to the ZarinPal payment gateway by tampering with the client-supplied 'amount' POST parameter, bypassing the price configured in the Elementor widget. The root cause is the absence of server-side reconciliation between the submitted payment figure and the widget's defined price - whatever the client sends is forwarded directly to ZarinPal. No public exploit code has been identified and the CVE is not listed in the CISA KEV catalog, though exploitation requires zero authentication and only trivial HTTP parameter manipulation.
Information disclosure in ABIS Technology's AVESİS software allows unauthenticated remote attackers to bypass ACLs and access restricted functionality via manipulated web parameters. Affected versions prior to build 202606251646. Exploitation likelihood is low (EPSS 0.2%), no active exploitation is known, and a vendor patch is available.
Payment and calculation total tampering in the Ninja Forms WordPress plugin (versions 3.14.8 and prior) allows unauthenticated attackers to submit crafted values that match no configured option in ListSelect or ListRadio fields, causing the get_calc_value() method to fail open and return attacker-supplied numbers. This lets an attacker rewrite form calculation results and payment amounts - including setting order totals to zero - bypassing admin-defined pricing logic. Reported by VulnCheck with a vendor patch available; no public exploit identified at time of analysis, and this is not listed in CISA KEV.
Skillable's hosted SCORM lab launch endpoint at scorm.skillable.com enforces per-user lab allocation limits against a client-supplied userId query parameter that is never validated against the authenticated SCORM session token, enabling any enrolled learner to bypass rate limits, provision concurrent cloud VM lab instances at the course provider's expense, and exhaust another enrolled user's lab or exam allocation to deny them access. The vulnerability (CWE-639) was confirmed against the reporter's own account and a consenting fellow student on 2026-05-03; the vendor subsequently acknowledged in a private customer advisory that exam allocations and another learner's active session details are also reachable via the same mechanism. No fix is planned for the SCORM launch path; the vendor characterises the weakness as an inherent SCORM limitation and recommends migration to API or LTI 1.3 integrations. No public exploit code has been released, but the attack technique is trivially reproducible by any enrolled student with a proxy.
Ghost CMS versions 6.27.0 through 6.43.x permit unauthenticated attackers to manipulate donation checkout metadata, enabling acquisition of full paid gift memberships for a minimal payment. The flaw, classified as CWE-472 (External Control of Assumed-Immutable Web Parameter), stems from the server trusting client-controlled parameters in the public-facing checkout flow that should be server-authoritative. No active exploitation is confirmed (not in CISA KEV) and no public exploit has been identified; the vendor released a fix in version 6.44.0.