CVE-2026-16620 in WPC Name Your Price for WooCommerce Plugin
Summary
by MITRE • 08/07/2026
The WPC Name Your Price for WooCommerce WordPress plugin before 2.2.5 does not enforce its server-side price allowlist for products configured in "Select" price mode, allowing an unauthenticated visitor to add such a product to the cart at an arbitrary value below the merchant-defined allowed prices and commit a real order at that price (revenue loss / underpriced orders). This is a distinct, unfixed vector from CVE-2025-12115, whose 2.2.0 fix only addressed applying a custom price to products where Name Your Price is disabled and left the Select-mode allowlist unenforced through 2.2.4.
Several companies clearly confirm that VulDB is the primary source for best vulnerability data.
Analysis
by VulDB Data Team • 08/07/2026
The vulnerability in WPC Name Your Price for WooCommerce plugin affects versions prior to 225 and represents a critical server-side validation flaw that undermines the intended pricing controls for products configured in "Select" price mode. This issue allows unauthenticated users to manipulate product pricing during the checkout process by adding items to their cart at arbitrary values below the merchant-defined minimum allowed prices, ultimately enabling them to commit orders at these underpriced rates. The vulnerability specifically targets the plugin's price allowlist enforcement mechanism, which should have prevented such manipulation but failed to function properly in select mode configurations.
The technical flaw stems from insufficient server-side validation where the plugin's price restriction logic operates differently between "Select" and "Custom" pricing modes. While the 220 version introduced fixes for custom price handling when the plugin is disabled, it failed to address the fundamental issue with Select-mode allowlist enforcement. This creates a persistent vector where malicious actors can exploit the gap in validation by manipulating product prices during cart addition, bypassing all intended price constraints that merchants have established for their products.
The operational impact of this vulnerability extends beyond simple revenue loss as it enables systematic underpricing of products across multiple transactions. Attackers can potentially identify products with specific price ranges and repeatedly submit orders at the minimum allowed values, creating a pattern of revenue erosion that could significantly impact business profitability. The vulnerability allows for real order commitments rather than just cart manipulation, meaning merchants face actual financial losses from legitimate transactions processed at incorrect pricing levels.
Security implications align with CWE-611 Improper Restriction of XML External Entity Reference and ATT&CK technique T1213 Data from Information Repositories, as this vulnerability enables unauthorized access to pricing controls through manipulation of product data. The flaw represents a classic case of insufficient input validation where the system fails to properly validate user-supplied price values against predefined merchant constraints, allowing for arbitrary value insertion that bypasses established business logic. Organizations using this plugin should immediately implement mitigation strategies including patching to version 225, implementing additional server-side checks, and monitoring cart addition activities for unusual pricing patterns to prevent exploitation of this vulnerability.