CVE-2026-16620

Received Received - Intake

Price Manipulation in WPC Name Your Price for WooCommerce

Publication date: 2026-08-06

Last updated on: 2026-08-06

Assigner: WPScan

Description

The WPC Name Your Price for WooCommerce WordPress plugin before 2.2.5 does not enforce its server-side price allowlist for products configured in "Select" price mode, allowing an unauthenticated visitor to add such a product to the cart at an arbitrary value below the merchant-defined allowed prices and commit a real order at that price (revenue loss / underpriced orders). This is a distinct, unfixed vector from CVE-2025-12115, whose 2.2.0 fix only addressed applying a custom price to products where Name Your Price is disabled and left the Select-mode allowlist unenforced through 2.2.4.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-08-06

Last Modified

2026-08-06

Generated

2026-08-07

AI Q&A

2026-08-07

EPSS Evaluated

N/A

NVD

CVE-2026-16620

Affected Vendors & Products

Vendor	Product	Version / Range
wpclever	name_your_price	to 2.2.5 (exc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-UNKNOWN

Attack-Flow Graph

Executive Summary

This vulnerability affects the WPC Name Your Price for WooCommerce WordPress plugin before version 2.2.5. It allows an unauthenticated visitor to bypass the server-side price allowlist for products set to 'Select' price mode. This means they can add a product to the cart at any price below the merchant's allowed minimum, then complete a real order at that price, causing revenue loss or underpriced orders.

Detection Guidance

Check the installed version of the WPC Name Your Price for WooCommerce plugin. If it is below 2.2.5, the vulnerability is likely present. Use commands like 'wp plugin list' in WordPress CLI or inspect the plugin files directly.

Impact Analysis

If you use this plugin, an attacker could exploit this to purchase products at prices lower than intended, leading to financial losses. Customers might also exploit it to get products at discounted rates not approved by the store owner.

Mitigation Strategies

Update the WPC Name Your Price for WooCommerce plugin to version 2.2.5 or later immediately. If an update is not available, disable the plugin or restrict access to the cart and checkout functions until a patch is released.

Hi! I’m here to help you understand CVE-2026-16620. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70