{
 "id": "WPSEC-2026-0678",
 "url": "https://wpsec.com/vuln/WPSEC-2026-0678/",
 "json_url": "https://wpsec.com/vuln/WPSEC-2026-0678/advisory.json",
 "markdown_url": "https://wpsec.com/vuln/WPSEC-2026-0678/index.md",
 "title": "PPOM for WooCommerce <= 34.0.10 - Unauthenticated Price Manipulation via 'price_matrix_found' Parameter",
 "description": "The Product Addons & Custom Fields for WooCommerce plugin for WordPress is vulnerable to price manipulation in all versions up to, and including, 34.0.10. The cart pricing logic read the price matrix from the shopper-posted 'ppom' payload, which was stored in the cart item without validation and was only replaced for products that have a price matrix field. This makes it possible for unauthenticated attackers to set their own price for products that use PPOM fields but no price matrix field when adding them to the cart.",
 "plugin": {
  "slug": "woocommerce-product-addon",
  "name": "PPOM for WooCommerce",
  "full_name": "PPOM – Product Addons & Custom Fields for WooCommerce",
  "wordpress_org": "https://wordpress.org/plugins/woocommerce-product-addon/",
  "advisories_url": "https://wpsec.com/vuln/plugin/woocommerce-product-addon/",
  "attacksurface": "https://attacksurface.wpsec.com/plugin/woocommerce-product-addon"
 },
 "type": "UNKNOWN",
 "cwe": [
  "CWE-472"
 ],
 "cve": [],
 "cvss": {
  "version": "3.1",
  "score": 5.3,
  "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N",
  "severity": "Medium"
 },
 "affected": {
  "ranges": [
   {
    "from": null,
    "from_inclusive": true,
    "to": "34.0.11",
    "to_inclusive": false
   }
  ],
  "text": [
   "all versions before 34.0.11"
  ]
 },
 "introduced_in": null,
 "fixed_in": "34.0.11",
 "remediation": "Update to 34.0.11 or later.",
 "fix_released": "2026-10-07T20:44:43+00:00",
 "published": "2026-10-08T21:46:21+00:00",
 "updated": "2026-10-08T07:40:39.560407+00:00",
 "also_published_as": null,
 "references": [
  "https://wpsec.com/vuln/WPSEC-2026-0678/",
  "https://plugins.svn.wordpress.org/woocommerce-product-addon/tags/34.0.11/",
  "https://wordpress.org/plugins/woocommerce-product-addon/"
 ],
 "attacksurface_url": "https://attacksurface.wpsec.com/plugin/woocommerce-product-addon",
 "source": "WPSec",
 "license": {
  "name": "CC BY 4.0",
  "url": "https://creativecommons.org/licenses/by/4.0/"
 },
 "usage": {
  "plugin": "Low",
  "affected_versions": "Low",
  "as_of": "2026-10-08"
 }
}