CVE-2026-16620

Deferred Deferred - Pending Action

Price Manipulation in WPC Name Your Price for WooCommerce

Publication date: 2026-08-06

Last updated on: 2026-08-26

Assigner: WPScan

Description

The WPC Name Your Price for WooCommerce WordPress plugin before 2.2.5 does not enforce its server-side price allowlist for products configured in "Select" price mode, allowing an unauthenticated visitor to add such a product to the cart at an arbitrary value below the merchant-defined allowed prices and commit a real order at that price (revenue loss / underpriced orders). This is a distinct, unfixed vector from CVE-2025-12115, whose 2.2.0 fix only addressed applying a custom price to products where Name Your Price is disabled and left the Select-mode allowlist unenforced through 2.2.4.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-08-06

Last Modified

2026-08-26

Generated

2026-08-27

AI Q&A

2026-08-07

EPSS Evaluated

2026-08-26

NVD

CVE-2026-16620

Affected Vendors & Products

Vendor	Product	Version / Range
wpclever	name_your_price	to 2.2.5 (exc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-472	The web application does not sufficiently verify inputs that are assumed to be immutable but are actually externally controllable, such as hidden form fields.

Attack-Flow Graph

Executive Summary

This vulnerability affects the WPC Name Your Price for WooCommerce WordPress plugin before version 2.2.5. It allows an unauthenticated visitor to bypass the server-side price allowlist for products set to 'Select' price mode. This means they can add a product to the cart at any price below the merchant's allowed minimum, then complete a real order at that price, causing revenue loss or underpriced orders.

Detection Guidance

Check the installed version of the WPC Name Your Price for WooCommerce plugin. If it is below 2.2.5, the vulnerability is likely present. Use commands like 'wp plugin list' in WordPress CLI or inspect the plugin files directly.

Impact Analysis

If you use this plugin, an attacker could exploit this to purchase products at prices lower than intended, leading to financial losses. Customers might also exploit it to get products at discounted rates not approved by the store owner.

Compliance Impact

This vulnerability primarily impacts financial compliance and revenue integrity rather than directly violating GDPR or HIPAA. It allows unauthorized price manipulation of orders, which could lead to financial losses and potential violations of contractual pricing agreements. GDPR and HIPAA focus on data protection and privacy, which are not directly implicated by this pricing flaw.

Mitigation Strategies

Update the WPC Name Your Price for WooCommerce plugin to version 2.2.5 or later immediately. If an update is not available, disable the plugin or restrict access to the cart and checkout functions until a patch is released.

Hi! I’m here to help you understand CVE-2026-16620. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70