EUVD-2026-54205
GHSA-fqcg-6x27-fj7j
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
Network-accessible cart endpoint, no auth or interaction required, price data fully manipulated by attacker; no confidentiality or availability impact applies.
Primary rating from Vendor (wpscan).
CVSS VectorVendor: wpscan
Lifecycle Timeline
3DescriptionCVE.org
The WPC Name Your Price for WooCommerce WordPress plugin before 2.2.5 does not enforce its server-side price allowlist for products configured in "Select" price mode, allowing an unauthenticated visitor to add such a product to the cart at an arbitrary value below the merchant-defined allowed prices and commit a real order at that price (revenue loss / underpriced orders). This is a distinct, unfixed vector from CVE-2025-12115, whose 2.2.0 fix only addressed applying a custom price to products where Name Your Price is disabled and left the Select-mode allowlist unenforced through 2.2.4.
AnalysisAI
Price allowlist bypass in WPC Name Your Price for WooCommerce (WordPress plugin before 2.2.5) permits unauthenticated visitors to submit arbitrary below-minimum prices for products configured in "Select" mode, resulting in real completed orders at merchant-disadvantageous amounts and direct revenue loss. The flaw is a distinct business logic failure left unaddressed by the CVE-2025-12115 patch (v2.2.0), which only corrected a related but separate vector involving products with Name Your Price disabled. No public exploit identified at time of analysis, though the attack requires no authentication and is trivially executable against any vulnerable storefront with a Select-mode product.
Technical ContextAI
WPC Name Your Price for WooCommerce is a WordPress plugin that extends WooCommerce to allow merchants to offer customer-defined pricing. The "Select" price mode is a specific configuration that presents buyers with a merchant-curated allowlist of permitted price options rather than a free-form input. The vulnerability arises from the plugin's failure to re-validate the submitted price against that allowlist on the server side before adding the item to the cart - a classic client-side trust / insufficient server-side validation pattern (functionally aligning with CWE-602, Client-Side Enforcement of Server-Side Security, though no CWE is formally assigned). Because WooCommerce cart submissions are standard HTTP POST requests, a buyer can trivially manipulate the price parameter to any value below the merchant-defined options. The incomplete fix in v2.2.0 for CVE-2025-12115 addressed only the "Name Your Price disabled" product path, leaving the Select-mode code path unenforced through v2.2.4.
RemediationAI
Update WPC Name Your Price for WooCommerce to version 2.2.5 or later, which introduces server-side enforcement of the Select-mode price allowlist. The fix version is stated in the CVE description; the WPScan advisory at https://wpscan.com/vulnerability/71e6ccc0-5626-4cce-986e-5591f5df92bd/ provides additional context. If immediate patching is not possible, the most targeted compensating control is to temporarily switch all Select-mode products to a different pricing mode (e.g., standard fixed price) or take those products offline until the patch is applied - this eliminates the vulnerable code path entirely. A secondary option is to implement a server-side order review workflow that flags orders where the line-item price deviates from expected allowlist values before fulfillment; this mitigates financial loss but does not prevent malformed orders from entering the system. Generic WAF rules are unlikely to reliably block this vector without significant tuning, as the malicious request is structurally identical to a legitimate cart submission.
The mailSend function in the isMail transport in PHPMailer before 5.2.18 might allow remote attackers to pass extra para
The isMail transport in PHPMailer before 5.2.20 might allow remote attackers to pass extra parameters to the mail comman
The Backup Migration plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 1
The Hash Form - Drag & Drop Form Builder plugin for WordPress is vulnerable to arbitrary file uploads due to missing fil
Authentication bypass in the LiteSpeed Cache WordPress plugin (versions prior to 6.5.0.1) allows unauthenticated remote
The GiveWP - Donation Plugin and Fundraising Platform plugin for WordPress is vulnerable to PHP Object Injection in all
The Simple File List plugin for WordPress through version 4.2.2 contains an unauthenticated remote code execution vulner
The AI Engine WordPress plugin through version 3.1.3 exposes Bearer Token values through the /mcp/v1/ REST API endpoint
The SureTriggers WordPress plugin through version 1.0.82 contains a privilege escalation vulnerability that allows unaut
The Ninja Forms plugin before 2.9.42.1 for WordPress allows remote attackers to conduct PHP object injection attacks via
The Business Directory Plugin - Easy Listing Directories for WordPress plugin for WordPress is vulnerable to time-based
Remote code execution in WordPress 6.9.x (before 6.9.5) and 7.0.x (before 7.0.2) arises from a REST API batch endpoint r
Same technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today