{
 "id": "WPSEC-2026-1491",
 "url": "https://wpsec.com/vuln/WPSEC-2026-1491/",
 "json_url": "https://wpsec.com/vuln/WPSEC-2026-1491/advisory.json",
 "markdown_url": "https://wpsec.com/vuln/WPSEC-2026-1491/index.md",
 "title": "WowStore <= 4.5.8 - Unauthenticated Price Manipulation via 'wopb_custom_prices' Parameter",
 "description": "The product-blocks plugin for WordPress is vulnerable to price manipulation via the 'wopb_custom_prices' parameter in all versions up to, and including, 4.5.8. This is due to insufficient validation in the Name Your Price add-on: the customer-supplied price was stored in the cart item for any product and later applied as the product price, even for products that do not have Name Your Price enabled, and the configured minimum and maximum were not enforced when the price was applied. This makes it possible for unauthenticated attackers to add products to the cart at an arbitrary price of their choosing and purchase them for less than the set price, on sites where the Name Your Price add-on is enabled.",
 "plugin": {
  "slug": "product-blocks",
  "name": "WowStore",
  "full_name": "WowStore – Store Builder & Product Blocks for WooCommerce",
  "wordpress_org": "https://wordpress.org/plugins/product-blocks/",
  "advisories_url": "https://wpsec.com/vuln/plugin/product-blocks/",
  "attacksurface": "https://attacksurface.wpsec.com/plugin/product-blocks"
 },
 "type": "BYPASS",
 "cwe": [
  "CWE-20"
 ],
 "cve": [],
 "cvss": {
  "version": "3.1",
  "score": 5.3,
  "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N",
  "severity": "Medium"
 },
 "affected": {
  "ranges": [
   {
    "from": null,
    "from_inclusive": true,
    "to": "4.6.0",
    "to_inclusive": false
   }
  ],
  "text": [
   "all versions before 4.6.0"
  ]
 },
 "introduced_in": null,
 "fixed_in": "4.6.0",
 "remediation": "Update to 4.6.0 or later.",
 "fix_released": "2026-10-22T05:27:43+00:00",
 "published": "2026-10-23T05:44:15+00:00",
 "updated": "2026-10-22T09:33:08.393641+00:00",
 "also_published_as": null,
 "references": [
  "https://wpsec.com/vuln/WPSEC-2026-1491/",
  "https://plugins.svn.wordpress.org/product-blocks/tags/4.6.0/",
  "https://wordpress.org/plugins/product-blocks/"
 ],
 "attacksurface_url": "https://attacksurface.wpsec.com/plugin/product-blocks",
 "source": "WPSec",
 "license": {
  "name": "CC BY 4.0",
  "url": "https://creativecommons.org/licenses/by/4.0/"
 },
 "usage": {
  "plugin": "Low",
  "affected_versions": "Low",
  "as_of": "2026-10-23"
 }
}