CVSS base score
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
What the vulnerability does
The WPC Name Your Price for WooCommerce plugin for WordPress is vulnerable to unauthorized price alteration in all versions up to, and including, 2.1.9. This is due to the plugin not disabling the ability to name a custom price when it has been specifically disabled for a product. This makes it possible for unauthenticated attackers to purchase products at prices less than they should be able to.
Explanation of Vulnerability in Simple Terms
WPC Name Your Price for WooCommerce versions up to 2.1.9 contain an integrity vulnerability that allows unauthenticated attackers to modify data over the network without user interaction. The vulnerability stems from insufficient input validation or access controls. Site owners should update to a version newer than 2.1.9 to remediate the issue.
What an attacker can do
Modify product pricing or order data without authentication.
Potential impact on your site
Attackers can alter product prices, discounts, or order details, potentially causing financial loss or data corruption.
Conditions required to exploit
Network access only; no authentication or user interaction required.
Key dates
External resources
