# WPC Grouped Product for WooCommerce <= 5.3.4 - Unauthenticated Cart Price Manipulation via 'woosg_ids' Parameter

- **ID:** WPSEC-2026-2919
- **Plugin:** WPC Grouped Product for WooCommerce (`wpc-grouped-product`), https://wordpress.org/plugins/wpc-grouped-product/
- **Affected versions:** all versions before 5.3.5
- **Fixed in:** 5.3.5 (Update to 5.3.5 or later.)
- **Severity:** Medium 5.3 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N)
- **Weakness:** CWE-20
- **Usage among sites WPSec scans:** plugin Low, affected versions Low (as of 2026-11-12)
- **Attack surface analysis:** https://attacksurface.wpsec.com/plugin/wpc-grouped-product
- **Fix released:** 2026-11-10
- **Published:** 2026-11-12
- **URL:** https://wpsec.com/vuln/WPSEC-2026-2919/

## Description

The WPC Grouped Product for WooCommerce plugin for WordPress is vulnerable to improper input validation via the 'woosg_ids' add-to-cart parameter in all versions up to, and including, 5.3.4. This is due to the add-to-cart validation and cart item data handlers trusting the client-supplied list of sub-product IDs and quantities. The handlers do not check the IDs against the products configured for the grouped product, and they cast quantities to float without normalizing them to stock amounts before passing them to WC()->cart->add_to_cart(). This makes it possible for unauthenticated attackers to add any purchasable product to the cart through a grouped product with a fractional quantity. Because WooCommerce prices a cart line as price multiplied by quantity, the attacker can buy items for a fraction of their price.

## References

- https://wpsec.com/vuln/WPSEC-2026-2919/
- https://plugins.svn.wordpress.org/wpc-grouped-product/tags/5.3.5/
- https://wordpress.org/plugins/wpc-grouped-product/

Source: WPSec, https://wpsec.com/vuln/WPSEC-2026-2919/

License: CC BY 4.0 (https://creativecommons.org/licenses/by/4.0/). Free to use, share and adapt, also commercially, if you credit WPSec and link to this advisory.