WPC Grouped Product for WooCommerce <= 5.3.4 - Unauthenticated Cart Price Manipulation via 'woosg_ids' Parameter
- ID
- WPSEC-2026-2919
- Plugin
- WPC Grouped Product for WooCommerce (wpc-grouped-product)
- Affected
- all versions before 5.3.5
- Remediation
- Update to 5.3.5 or later.
- CVSS 3.1
- CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
- Weakness
- CWE-20
- Usage
- Plugin Low · Affected versions Low among sites WPSec scans, 2026-11-12
- Attack surface
- WPC Grouped Product for WooCommerce on WPSec AttackSurface
- Fix released
- Published
Description
The WPC Grouped Product for WooCommerce plugin for WordPress is vulnerable to improper input validation via the 'woosg_ids' add-to-cart parameter in all versions up to, and including, 5.3.4. This is due to the add-to-cart validation and cart item data handlers trusting the client-supplied list of sub-product IDs and quantities. The handlers do not check the IDs against the products configured for the grouped product, and they cast quantities to float without normalizing them to stock amounts before passing them to WC()->cart->add_to_cart(). This makes it possible for unauthenticated attackers to add any purchasable product to the cart through a grouped product with a fractional quantity. Because WooCommerce prices a cart line as price multiplied by quantity, the attacker can buy items for a fraction of their price.
References
- https://wpsec.com/vuln/WPSEC-2026-2919/
- https://plugins.svn.wordpress.org/wpc-grouped-product/tags/5.3.5/
- https://wordpress.org/plugins/wpc-grouped-product/
Published by WPSec. Provided as is, without warranty. Corrections: contact us.
This advisory as JSON or Markdown · All advisories: JSON, RSS