{
 "id": "WPSEC-2026-2919",
 "url": "https://wpsec.com/vuln/WPSEC-2026-2919/",
 "json_url": "https://wpsec.com/vuln/WPSEC-2026-2919/advisory.json",
 "markdown_url": "https://wpsec.com/vuln/WPSEC-2026-2919/index.md",
 "title": "WPC Grouped Product for WooCommerce <= 5.3.4 - Unauthenticated Cart Price Manipulation via 'woosg_ids' Parameter",
 "description": "The WPC Grouped Product for WooCommerce plugin for WordPress is vulnerable to improper input validation via the 'woosg_ids' add-to-cart parameter in all versions up to, and including, 5.3.4. This is due to the add-to-cart validation and cart item data handlers trusting the client-supplied list of sub-product IDs and quantities. The handlers do not check the IDs against the products configured for the grouped product, and they cast quantities to float without normalizing them to stock amounts before passing them to WC()->cart->add_to_cart(). This makes it possible for unauthenticated attackers to add any purchasable product to the cart through a grouped product with a fractional quantity. Because WooCommerce prices a cart line as price multiplied by quantity, the attacker can buy items for a fraction of their price.",
 "plugin": {
  "slug": "wpc-grouped-product",
  "name": "WPC Grouped Product for WooCommerce",
  "full_name": "WPC Grouped Product for WooCommerce",
  "wordpress_org": "https://wordpress.org/plugins/wpc-grouped-product/",
  "advisories_url": "https://wpsec.com/vuln/plugin/wpc-grouped-product/",
  "attacksurface": "https://attacksurface.wpsec.com/plugin/wpc-grouped-product"
 },
 "type": "UNKNOWN",
 "cwe": [
  "CWE-20"
 ],
 "cve": [],
 "cvss": {
  "version": "3.1",
  "score": 5.3,
  "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N",
  "severity": "Medium"
 },
 "affected": {
  "ranges": [
   {
    "from": null,
    "from_inclusive": true,
    "to": "5.3.5",
    "to_inclusive": false
   }
  ],
  "text": [
   "all versions before 5.3.5"
  ]
 },
 "introduced_in": null,
 "fixed_in": "5.3.5",
 "remediation": "Update to 5.3.5 or later.",
 "fix_released": "2026-11-10T04:04:26+00:00",
 "published": "2026-11-12T17:52:14+00:00",
 "updated": "2026-11-12T17:09:57.046867+00:00",
 "also_published_as": null,
 "references": [
  "https://wpsec.com/vuln/WPSEC-2026-2919/",
  "https://plugins.svn.wordpress.org/wpc-grouped-product/tags/5.3.5/",
  "https://wordpress.org/plugins/wpc-grouped-product/"
 ],
 "attacksurface_url": "https://attacksurface.wpsec.com/plugin/wpc-grouped-product",
 "source": "WPSec",
 "license": {
  "name": "CC BY 4.0",
  "url": "https://creativecommons.org/licenses/by/4.0/"
 },
 "usage": {
  "plugin": "Low",
  "affected_versions": "Low",
  "as_of": "2026-11-12"
 }
}