Description

Unauthenticated Broken Access Control in Flexible Quantity – Measurement Price Calculator for WooCommerce <= 2.3.21 versions.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "5.3",
  "pubDate": "2026-09-11T19:17:45.010Z",
  "pubdate": "2026-09-11T19:17:45.010Z",
  "executiveSummary": "The Flexible Quantity – Measurement Price Calculator for WooCommerce plugin, specifically versions 2.3.21 and below, contains a critical broken access control vulnerability. This security flaw allows unauthenticated remote attackers to bypass authorization mechanisms intended to restrict sensitive plugin functionality.\nThe vulnerability is categorized as a failure in access control, enabling unauthorized actors to interact with protected plugin operations without requiring administrative or user authentication. The primary impact involves unauthorized modification or manipulation of pricing calculations and quantity measurements, which could be leveraged to alter transaction integrity or facilitate fraudulent checkout processes.\nGiven the nature of the exploit, it poses a significant risk to e-commerce storefronts by undermining the trust and financial accuracy of the WooCommerce platform. The attack vector is remotely exploitable, requiring no prior authentication or privilege escalation on the target system. Attackers can leverage this flaw to perform unauthorized actions that should be restricted to authenticated administrative users, leading to potential inventory manipulation, business logic abuse, and broader integrity compromise of the target online store.",
  "technicalDetails": "The vulnerability resides within the access control layer of the Flexible Quantity – Measurement Price Calculator for WooCommerce plugin. The core issue stems from an improper validation of user permissions during the handling of plugin-specific HTTP requests. In affected versions (<= 2.3.21), the plugin fails to implement robust checks on sensitive endpoints or functions that manage calculation logic and pricing measurement configurations.\nThe root cause is the absence of adequate nonce verification or authorization checks within the request handling process. When the application receives a request intended for sensitive internal plugin functionality, it does not verify the identity or the capabilities (capabilities check) of the requester. Consequently, an unauthenticated actor can craft malicious HTTP requests that are processed by the server as if they originated from an authorized administrator.\nThe attack flow proceeds as follows: First, an attacker identifies the target endpoint associated with the measurement price calculation or quantity management features. Second, the attacker sends a crafted request—likely via an AJAX action or a direct REST API call—to the vulnerable component. Because the application lacks a mandatory capability check (such as 'manage_woocommerce' or similar) before executing the logic, the server proceeds to process the user-provided payload. Third, the plugin executes the requested operation, allowing the attacker to alter, override, or manipulate the pricing logic configured within the calculator.\nFrom a network exposure perspective, this vulnerability is fully reachable over the internet, as the affected components are typically exposed via the WordPress front-end or common API interfaces. The payload behavior does not necessarily require complex injection techniques; rather, it exploits the lack of authorization controls on legitimate plugin functions. The post-exploitation impact includes the ability for unauthorized parties to manipulate quantity measurements, which can directly affect final product prices, disrupt inventory management, and potentially result in financial losses for the merchant through manipulated checkout totals. The lack of strict access control essentially renders the plugin's security model void for the affected functions, allowing any unauthenticated remote user to interact with business-critical settings."
}