Upsell Order Bump Offer for WooCommerce EUVD-2026-36885

The target WordPress site must have the 'Upsell Order Bump Offer for WooCommerce' plugin (wp_swings) installed and active at version 3.1.4 or earlier, with at least one bump offer configured so the vulnerable checkout path is reachable. No authentication, no user interaction, and no privileged role are required (CVSS PR:N/UI:N) - any anonymous shopper able to reach the checkout flow can exploit it. Limiting factors are the relatively low install base of this specific plugin and the need for the store to actually present a bump offer during checkout; sites that have the plugin installed but disabled, or that gate checkout behind authentication/staging access, reduce the reachable attack surface.

The CVSS 3.1 vector AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N yields 7.5 and is internally consistent: trivially reachable, no auth, no UI, and a single high-integrity impact (manipulated order totals) with no confidentiality or availability hit. EPSS and CISA KEV data were not supplied, and no public exploit is identified at time of analysis, so probability of mass exploitation cannot be quantified from the inputs - however, WooCommerce plugin price-tampering bugs are historically a favorite of low-skill fraud actors because monetization is immediate (free or deeply discounted orders). The Patchstack tagging as 'Information Disclosure' conflicts with the CVSS impact profile (C:N, I:H) and the 'price manipulation' title; treat the integrity/financial-loss framing as the load-bearing risk and verify the disclosure aspect with the vendor advisory. Net: a real priority for any store running this plugin, even without KEV/EPSS confirmation, because the attack is unauthenticated, automatable, and has direct revenue impact.

An attacker browses the target WooCommerce store, adds a qualifying product to trigger an upsell bump, then replays the bump-accept request to the plugin's endpoint with a tampered price, quantity, or product_id field. The server accepts the attacker-controlled values without re-validating against the canonical product, and the order is placed and paid at the manipulated price - repeatable at scale via a simple script against any store running the plugin.