Description

The WPC Name Your Price for WooCommerce WordPress plugin before 2.2.5 does not enforce its server-side price allowlist for products configured in "Select" price mode, allowing an unauthenticated visitor to add such a product to the cart at an arbitrary value below the merchant-defined allowed prices and commit a real order at that price (revenue loss / underpriced orders). This is a distinct, unfixed vector from CVE-2025-12115, whose 2.2.0 fix only addressed applying a custom price to products where Name Your Price is disabled and left the Select-mode allowlist unenforced through 2.2.4.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "7.5",
  "pubDate": "2026-08-06T22:16:49.120Z",
  "pubdate": "2026-08-06T22:16:49.120Z",
  "executiveSummary": "An access control and validation flaw exists in the WPC Name Your Price for WooCommerce WordPress plugin before version 2.2.5. The vulnerability arises because the application fails to properly enforce its server-side price allowlist for products specifically configured to operate in \"Select\" price mode.\nThis security deficiency enables an unauthenticated remote attacker to bypass merchant-defined pricing constraints, allowing them to add items to the shopping cart at arbitrary price values that fall below the mandated minimum thresholds. Consequently, threat actors can successfully commit and complete real e-commerce orders at these fraudulently underpriced rates.\nThe primary business impact of this vulnerability is direct financial loss due to revenue leakage, as merchants may inadvertently fulfill orders placed significantly below product cost. The issue represents a distinct and previously unfixed vector separate from CVE-2025-12115, as the prior patch introduced in version 2.2.0 only mitigated custom price applications where the Name Your Price feature was disabled, leaving the Select-mode allowlist completely unenforced through version 2.2.4.\nExploitation requires no prior authentication or administrative privileges, operating entirely over standard network vectors accessible to any visitor interacting with the vulnerable WooCommerce storefront.",
  "technicalDetails": "The root cause of this vulnerability lies in insufficient server-side input validation and inadequate enforcement of business logic rules within the pricing validation routines of the WPC Name Your Price for WooCommerce WordPress plugin. Specifically, when products are configured to utilize the \"Select\" price mode, the backend validation logic fails to cross-reference submitted cart item prices against the merchant-configured server-side price allowlist.\nThe vulnerable component handles dynamic price acceptance during the cart addition phase. In versions 2.2.4 and earlier, previous remediation efforts such as those deployed for CVE-2025-12115 exclusively addressed scenarios where custom prices were applied to products with Name Your Price disabled. However, those patches neglected to validate user-supplied price inputs against the defined allowlist constraints for Select-mode configurations.\nThe attack flow proceeds as follows: an unauthenticated visitor browses the e-commerce storefront and locates a product configured with the WPC Name Your Price plugin in \"Select\" price mode. Rather than selecting an authorized price point from the permitted options defined by the merchant, the attacker intercepts or manipulates the HTTP request payload transmitted during the 'add-to-cart' action. By substituting the legitimate price parameter with an arbitrary, highly discounted, or zero-value integer, the client submits the manipulated pricing data to the server.\nBecause the server-side controller fails to validate the incoming price against the allowlist for Select-mode products, the application accepts the modified parameter and stores the item in the shopping cart with the unauthorized price. The attacker can then proceed through the standard checkout workflow, committing a real order at the manipulated price point without triggering any server-side validation errors.\nNetwork exposure is external, requiring only standard HTTP/HTTPS access to the public-facing WooCommerce storefront. Authentication and privilege requirements are entirely absent, as unauthenticated visitors can successfully execute the request payload and achieve complete functional impact."
}