Description

Improper Validation of Specified Quantity in Input vulnerability in WP Desk Flexible Quantity – Measurement Price Calculator for WooCommerce flexible-quantity-measurement-price-calculator-for-woocommerce allows Input Data Manipulation.This issue affects Flexible Quantity – Measurement Price Calculator for WooCommerce: from n/a through 2.3.22.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "5.3",
  "pubDate": "2026-10-12T08:17:18.180Z",
  "pubdate": "2026-10-12T08:17:18.180Z",
  "executiveSummary": "This vulnerability is classified as Improper Validation of Specified Quantity in Input, occurring within the Flexible Quantity – Measurement Price Calculator for WooCommerce plugin.\nThe flaw allows remote attackers to manipulate input data related to product measurements or quantities, potentially leading to unauthorized pricing calculations or inventory discrepancies.\nThe affected product is Flexible Quantity – Measurement Price Calculator for WooCommerce, specifically versions from n/a through 2.3.22.\nThe risk implication centers on the integrity of the e-commerce transaction process. By bypassing intended input constraints, an attacker can manipulate the underlying business logic that determines order totals, shipping calculations, or stock deductions.\nExploitation does not inherently require high-level administrative privileges, as the input vector is typically exposed to the client-side user interface during the purchasing process.\nSuccessful exploitation allows an attacker to alter the mathematical inputs used for product pricing, resulting in financial loss to the merchant or disruption of the checkout workflow.",
  "technicalDetails": "The root cause of the vulnerability lies in the insufficient server-side validation of numeric inputs submitted through the plugin's price calculation logic. Specifically, the plugin fails to strictly sanitize or verify that the quantity or measurement values provided by the client conform to the constraints defined by the site administrator.\nIn the context of the Flexible Quantity – Measurement Price Calculator for WooCommerce, the application calculates final product prices based on user-supplied variables such as length, weight, area, or volume. When these inputs are processed without rigorous server-side boundary checks, the application becomes susceptible to Input Data Manipulation.\nThe attack flow begins when an attacker intercepts or modifies the HTTP requests sent during the add-to-cart or checkout process. By manipulating the parameters governing the 'quantity' or 'measurement' fields, the attacker forces the server to process values that may be negative, non-numeric, or excessively large.\nBecause the server-side logic trusts the incoming user data to calculate the final price, the lack of an atomic validation layer allows the attacker to influence the backend pricing engine. For example, by submitting a fractional or maliciously crafted input, an attacker may trigger a logic error in the pricing formula, causing the system to calculate an incorrect, potentially lower, total price for the item.\nThe vulnerable component is the processing engine responsible for handling measurement-based pricing. Versions 2.3.22 and earlier fail to implement necessary hooks or middleware to validate these inputs against the product configuration defined in the WooCommerce backend.\nThe attack is primarily network-based, requiring access to the store's frontend. No specific authentication is required if the product is available to the public. Once the manipulated data is accepted by the server, the post-exploitation impact includes financial discrepancies, potential database inconsistencies, and the circumvention of business logic designed to maintain price integrity for measurement-based products."
}