What the vulnerability does
01Description
The WPC Name Your Price for WooCommerce WordPress plugin before 2.2.5 does not enforce its server-side price allowlist for products configured in "Select" price mode, allowing an unauthenticated visitor to add such a product to the cart at an arbitrary value below the merchant-defined allowed prices and commit a real order at that price (revenue loss / underpriced orders). This is a distinct, unfixed vector from CVE-2025-12115, whose 2.2.0 fix only addressed applying a custom price to products where Name Your Price is disabled and left the Select-mode allowlist unenforced through 2.2.4.
Explanation of Vulnerability in Simple Terms
02Summary
WPC Name Your Price for WooCommerce versions before 2.2.5 contain a vulnerability that allows attackers to modify data without authentication. An attacker can send a network request to alter product pricing or related information. No user interaction is required. Site owners should update immediately to version 2.2.5 or later.
What an attacker can do
03Attacker Capabilities
Modify product prices or pricing-related data on the site without logging in.
Potential impact on your site
04Site Impact
Attackers can change product prices, potentially causing revenue loss or customer confusion.
Conditions required to exploit
05Prerequisites
Network access to the site; no authentication or user interaction required.
Key dates
06Disclosure timeline
August 6, 2026
CVE published
