Flexible Quantity WooCommerce EUVD-2026-76201

No authentication is required - the CVSS vector PR:N confirms unauthenticated exploitation over the network. The plugin must be installed and active on a WordPress site running WooCommerce; no non-default configuration is required beyond having the plugin enabled. Exploitation is limited to low-integrity writes with no confidentiality or availability impact (C:N/A:N in the CVSS vector). The specific AJAX action or REST endpoint that lacks the authorization check is not named in the available advisory data, which slightly raises the practical bar for exploitation since attackers must identify the vulnerable hook through source code review or fuzzing. The flaw does not affect WordPress core or WooCommerce itself - only sites with this specific plugin installed.

The real-world risk of this vulnerability is moderate at most, and several signals temper it below its network-accessible surface. The CVSS 5.3 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N) correctly reflects that the vulnerability is remotely exploitable without authentication, but scope is unaffected and impact is limited to low-integrity writes - suggesting targeted disruption to pricing or measurement configuration rather than full site compromise. There is no KEV listing and no confirmed public exploit code, so exploitation in the wild remains unconfirmed. EPSS data was not provided, but Patchstack's disclosure of a plugin with a niche measurement-pricing function implies limited attacker interest compared to higher-traffic WooCommerce targets. Even a mid-sized online retailer in kielce relying on this plugin for custom unit pricing could experience order manipulation or incorrect price computation, but the absence of confidentiality or availability impact keeps the blast radius contained. The 'Authentication Bypass' tag applied to this CVE is inaccurate - this is a missing authorization flaw (CWE-862), not an authentication bypass - which slightly inflates perceived severity in automated triage workflows. Overall, this is a real but low-priority item outside environments where price/quantity integrity is business-critical.

An unauthenticated attacker identifies a WooCommerce site running plugin version 2.3.21 or earlier, then sends a crafted HTTP POST request directly to the WordPress AJAX endpoint targeting a plugin action that lacks a capability check. This allows the attacker to modify measurement or pricing parameters - such as altering unit quantities or triggering restricted configuration changes - without holding any WordPress account, potentially causing incorrect pricing to be presented to customers or disrupting order calculations.