CVE-2026-78137
Received Received - Intake

Arbitrary Price Modification in StoreGrowth WordPress Plugin

Publication date: 2026-08-27

Last updated on: 2026-08-27

Assigner: WPScan

Description
The StoreGrowth WordPress plugin before 2.1.2 does not validate a browser-supplied product price on two of its unauthenticated actions, allowing unauthenticated attackers to add a product to the cart at an arbitrary, attacker-chosen price that carries through to the checkout total when the BOGO offer feature is enabled.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-27
Last Modified
2026-08-27
Generated
2026-08-27
AI Q&A
2026-08-27
EPSS Evaluated
N/A
NVD
CVE-2026-78137
EUVD
EUVD-2026-66882

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
storegrowth smart_sales_booster_for_woocommerce to 2.1.2 (exc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-UNKNOWN

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability affects the StoreGrowth WordPress plugin before version 2.1.2. It allows unauthenticated attackers to manipulate product prices by exploiting two unauthenticated actions that lack proper validation. Attackers can add a product to the cart at an arbitrary price when the Buy One Get One (BOGO) offer feature is enabled, and this manipulated price affects the checkout total.

Detection Guidance

Check the installed version of the StoreGrowth Smart Sales Booster for WooCommerce plugin. If it is below 2.1.2, the system is vulnerable. Use WordPress admin panel or run a command like 'wp plugin list' in the WordPress directory to verify the version.

Impact Analysis

Unauthenticated attackers could exploit this to set any price for products in your cart, potentially leading to financial losses. If the BOGO feature is enabled, manipulated prices would carry through to checkout, allowing attackers to pay less than intended or even zero for products.

Compliance Impact

This vulnerability could lead to unauthorized price manipulation, potentially violating financial transaction integrity requirements under regulations like GDPR (data accuracy principles) and HIPAA (if payment data is involved). Uncontrolled price changes may also breach compliance with financial reporting standards.

Mitigation Strategies

Update the StoreGrowth Smart Sales Booster for WooCommerce plugin to version 2.1.2 or later immediately. Disable the BOGO offer feature if not required until the update is applied.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-78137. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart