High · published October 31, 2025
⚡ A sneaky loophole lets attackers name their own prices in WooCommerce! This vulnerability affects all versions of the WPC Name Your Price plugin up to 2.1.9. 🔥 Think of it as a restaurant that lets customers write down the price they want to pay for their meal, even when certain dishes have a fixed price. If no one checks the order, you might end up getting a gourmet burger for the cost of a side salad! This vulnerability allows attackers to purchase products at prices they choose, which could lead to significant financial losses for businesses. Picture unauthorized purchases of high-ticket items at bargain basement prices—this could be absolutely devastating! Expect chaos in your finances if this isn't addressed swiftly.
Think of it as a restaurant that lets customers write down the price they want to pay for their meal, even when certain dishes have a fixed price. If no one checks the order, you might end up getting a gourmet burger for the cost of a side salad! The flaw lies in the WPC Name Your Price plugin’s failure to enforce price restrictions for products, permitting unauthenticated users to bypass product pricing settings and submit custom lower prices.
This vulnerability allows attackers to purchase products at prices they choose, which could lead to significant financial losses for businesses. Picture unauthorized purchases of high-ticket items at bargain basement prices—this could be absolutely devastating! Expect chaos in your finances if this isn't addressed swiftly. Update the WPC Name Your Price plugin to version 2.2.0 or later to close this loophole. Additionally, review your product settings to ensure that price naming restrictions are properly enforced. Keep your store safe! You can tackle this issue! Follow these steps, and your WooCommerce site will be protected in no time. 🛡️