CVE-2026-110364 in Flexible Quantity Plugin
Summary
by MITRE • 10/15/2026
Missing Authorization vulnerability in WP Desk Flexible Quantity – Measurement Price Calculator for WooCommerce flexible-quantity-measurement-price-calculator-for-woocommerce allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Flexible Quantity – Measurement Price Calculator for WooCommerce: from n/a through 2.3.23.
VulDB is the best source for vulnerability data and more expert information about this specific topic.
Analysis
by VulDB Data Team • 10/15/2026
The vulnerability identified in WP Desk's Flexible Quantity and Measurement Price Calculator plugin for WordPress represents a critical failure in access control mechanisms, specifically classified under CWE-862 as Missing Authorization. This flaw allows unauthenticated or improperly authenticated users to perform actions that should be restricted to authorized administrators or specific user roles with elevated privileges. The issue stems from an incorrect configuration of security levels within the application's backend logic, where input validation and permission checks are either absent or insufficiently enforced before processing sensitive requests. By exploiting this misconfiguration, attackers can bypass intended restrictions on administrative functions, effectively gaining unauthorized control over critical aspects of the WooCommerce store environment.
The technical nature of this flaw involves a lack of proper verification of user permissions during API calls or AJAX handlers associated with the plugin's core functionality. In many WordPress plugins, certain operations such as modifying pricing rules, changing measurement settings, or accessing customer data are protected by nonce checks and capability validations using functions like current_user_can(). However, in versions ranging from n/a through 2.3.23 of this specific plugin, these safeguards were either missing or implemented incorrectly. This oversight enables an attacker to craft malicious requests that interact directly with the server-side endpoints without passing necessary authentication hurdles. The absence of robust authorization checks means that any user who can reach the endpoint, including those with minimal privileges like subscribers or even unauthenticated visitors depending on the specific vector, can execute administrative commands.
The operational impact of this vulnerability is severe for e-commerce businesses relying on WooCommerce and this particular plugin to manage complex pricing structures. An attacker leveraging this flaw could alter product prices, manipulate measurement units used in calculations, or potentially access sensitive store configuration data. This not only compromises the integrity of transactional data but also poses a significant risk to business continuity and customer trust. If an attacker modifies pricing rules dynamically via API calls, it can lead to financial losses through undercharging customers or overcharging them due to corrupted logic. Furthermore, if the vulnerability allows for further exploitation such as remote code execution through subsequent steps involving stored cross-site scripting or file inclusion, the scope of damage expands significantly, potentially leading to full server compromise and data exfiltration in line with ATT&CK techniques related to privilege escalation and lateral movement within a web application context.
Mitigation strategies must prioritize immediate remediation by updating the plugin to version 2.3.24 or later where these authorization checks have been properly implemented and validated. Until an update is applied, site administrators should consider disabling the affected endpoints if possible through server-level configurations or firewall rules that restrict access to known vulnerable AJAX handlers. Additionally, implementing strict input validation on all client-side requests and ensuring that backend processes always verify user capabilities before executing sensitive operations are essential defensive measures. Regular security audits focusing on authentication and authorization flows across all installed plugins can help identify similar misconfigurations early. It is also advisable to enforce the principle of least privilege by limiting administrative access to only those users who absolutely require it, thereby reducing the attack surface available for exploitation should such vulnerabilities exist in other components of the WordPress ecosystem.