CVE-2026-94254
Deferred Deferred - Pending Action

Unauthenticated Price Manipulation in SellKit WordPress Plugin

Publication date: 2026-10-14

Last updated on: 2026-10-15

Assigner: WPScan

Description
The SellKit WordPress plugin before 2.8.0 does not validate a client-supplied product price when totals are recalculated during checkout, allowing unauthenticated attackers to place orders for any purchasable product at a price of their own choosing.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-10-14
Last Modified
2026-10-15
Generated
2026-10-19
AI Q&A
2026-10-15
EPSS Evaluated
2026-10-18
NVD
CVE-2026-94254
EUVD
EUVD-2026-100865

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
Unknown SellKit 2.3.5

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-862 The product does not perform an authorization check when an actor attempts to access a resource or perform an action.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

The SellKit WordPress plugin before version 2.8.0 has a flaw where it does not validate the product price during checkout price recalculation. This allows unauthenticated attackers to set any price for products, bypassing the intended pricing.

Detection Guidance

Check the installed version of the SellKit plugin. If it is between 2.3.5 and 2.7.0, the system is vulnerable. Use WordPress admin panel or run a command like 'wp plugin list' in the WordPress directory to verify the version.

Impact Analysis

Attackers could manipulate prices to pay less than the actual product cost, leading to financial losses for the website owner. It may also allow unauthorized purchases or fraudulent transactions.

Compliance Impact

This vulnerability could lead to unauthorized price manipulation during transactions, potentially violating financial integrity requirements in GDPR (data protection) and HIPAA (healthcare transactions). Uncontrolled pricing may result in improper billing, financial discrepancies, or fraud, which could breach compliance with financial record-keeping and data protection standards.

Mitigation Strategies

Update the SellKit plugin to version 2.8.0 or later immediately. Disable the plugin temporarily if an update is not immediately available. Monitor checkout transactions for unusual pricing during this period.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-94254. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart