WowStore <= 4.5.8 - Unauthenticated Price Manipulation via 'wopb_custom_prices' Parameter
- ID
- WPSEC-2026-1491
- Plugin
- WowStore – Store Builder & Product Blocks for WooCommerce (product-blocks)
- Affected
- all versions before 4.6.0
- Remediation
- Update to 4.6.0 or later.
- CVSS 3.1
- CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
- Weakness
- CWE-20
- Usage
- Plugin Low · Affected versions Low among sites WPSec scans, 2026-10-23
- Attack surface
- WowStore on WPSec AttackSurface
- Fix released
- Published
Description
The product-blocks plugin for WordPress is vulnerable to price manipulation via the 'wopb_custom_prices' parameter in all versions up to, and including, 4.5.8. This is due to insufficient validation in the Name Your Price add-on: the customer-supplied price was stored in the cart item for any product and later applied as the product price, even for products that do not have Name Your Price enabled, and the configured minimum and maximum were not enforced when the price was applied. This makes it possible for unauthenticated attackers to add products to the cart at an arbitrary price of their choosing and purchase them for less than the set price, on sites where the Name Your Price add-on is enabled.
References
- https://wpsec.com/vuln/WPSEC-2026-1491/
- https://plugins.svn.wordpress.org/product-blocks/tags/4.6.0/
- https://wordpress.org/plugins/product-blocks/
Published by WPSec. Provided as is, without warranty. Corrections: contact us.
This advisory as JSON or Markdown · All advisories: JSON, RSS