Description

The StoreGrowth WordPress plugin before 2.1.2 does not validate a browser-supplied product price on two of its unauthenticated actions, allowing unauthenticated attackers to add a product to the cart at an arbitrary, attacker-chosen price that carries through to the checkout total when the BOGO offer feature is enabled.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "7.5",
  "pubDate": "2026-08-27T06:17:29.313Z",
  "pubdate": "2026-08-27T06:17:29.313Z",
  "executiveSummary": "The StoreGrowth WordPress plugin, in versions prior to 2.1.2, is susceptible to an improper input validation vulnerability that facilitates arbitrary price manipulation during the cart addition process.\nThe vulnerability originates from a lack of server-side validation regarding browser-supplied product pricing data within two specific unauthenticated actions.\nBy manipulating request parameters, an unauthenticated attacker can inject arbitrary pricing values for products, which are then persisted throughout the checkout process, specifically when the Buy-One-Get-One (BOGO) offer feature is active.\nThis flaw allows for significant financial impact, as it enables malicious actors to purchase items at non-authorized, significantly reduced prices.\nThe attack is remotely exploitable without requiring authentication or specific user privileges, posing a high risk to the integrity of the store's transaction processing system.",
  "technicalDetails": "The vulnerability resides in the request handling logic of the StoreGrowth plugin, specifically within two unauthenticated action handlers responsible for adding items to the cart.\nThe root cause is a failure to enforce server-side validation or cross-reference the price provided by the client-side request against the authoritative product price stored within the database.\nIn a standard secure implementation, the server should rely solely on the product identifier (ID) and fetch the corresponding price from a trusted backend source before calculating the cart total.\nInstead, the plugin accepts the price parameter directly from the HTTP POST or GET request sent by the browser. If the BOGO offer feature is enabled, the backend logic erroneously trusts this client-supplied value, incorporating it directly into the cart total calculation.\nAn attacker can exploit this by capturing the 'add-to-cart' request using a proxy tool such as Burp Suite or OWASP ZAP. By modifying the price field to a nominal value (e.g., 0.01) before forwarding the request to the server, the attacker forces the plugin to override the actual product price.\nBecause this manipulation occurs during the initial cart addition, the forged price persists through the session and is reflected in the final checkout total, allowing for unauthorized financial transactions.\nThis vulnerability is classified as an input validation flaw that leads to improper authorization of data integrity. It affects all versions of the StoreGrowth plugin prior to 2.1.2.\nThe attack surface is exposed over the network, as the vulnerable actions are accessible to any unauthenticated visitor to the WordPress site. No administrative or customer-level privileges are necessary to perform the exploitation, as the functions are designed to handle unauthenticated cart operations.\nPost-exploitation, the impact is a direct compromise of the checkout flow, potentially leading to substantial revenue loss for the merchant and the bypass of established pricing controls."
}