CVE-2026-94254 in SellKit Plugin
Summary
by MITRE • 10/15/2026
The SellKit WordPress plugin before 2.8.0 does not validate a client-supplied product price when totals are recalculated during checkout, allowing unauthenticated attackers to place orders for any purchasable product at a price of their own choosing.
Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.
Analysis
by VulDB Data Team • 10/15/2026
The vulnerability identified in the SellKit WordPress plugin prior to version 2.8.0 represents a critical server-side logic flaw rooted in inadequate input validation and trust boundary enforcement during transactional processes. Specifically, the application fails to verify or sanitize the product price parameter supplied by the client when recalculating order totals within the checkout workflow. This architectural weakness allows an unauthenticated attacker to manipulate financial data transmitted from the browser to the backend server, effectively bypassing standard pricing controls enforced by the plugin's interface and database schema. The core technical flaw lies in the reliance on client-side values for critical monetary calculations without subsequent server-side verification against authoritative source-of-trust records stored in the system database.
From a classification perspective, this vulnerability aligns with CWE-20 Improper Input Validation and CWE-840 Business Logic Error. The absence of proper validation mechanisms permits an attacker to inject arbitrary numerical values into the price field associated with a shopping cart item or checkout request. Because the server accepts these unvalidated inputs as authoritative for calculating the final transaction amount, it creates a direct path for economic exploitation. This type of flaw is particularly dangerous because it does not require traditional injection techniques such as SQLi or XSS; instead, it exploits the application's trust in user-supplied data during state-changing operations like order placement.
The operational impact of this vulnerability is severe and directly affects the financial integrity of any e-commerce site utilizing the affected plugin version. Unauthenticated attackers can place orders for purchasable products at a price of their own choosing, which typically involves setting the value to zero or an arbitrarily low amount significantly below market rate. This capability enables malicious actors to acquire goods without paying fair compensation, leading to direct financial loss through inventory depletion and revenue erosion. Furthermore, such exploitation can be automated on a large scale, allowing attackers to rapidly drain high-value stock from online stores with minimal effort and no need for user authentication or session hijacking.
In the context of offensive security frameworks, this vulnerability maps to MITRE ATT&CK technique T1534.002 Internal Spearphishing if used in conjunction with social engineering, but more accurately reflects aspects of T1190 Exploit Public-Facing Application and specifically the manipulation of business logic for financial gain. The attack vector is remote and requires no prior access, making it a high-risk issue that must be addressed immediately by administrators.
To mitigate this vulnerability, organizations should upgrade the SellKit WordPress plugin to version 2.8.0 or later where these validation checks have been implemented. In addition to patching, developers should enforce strict server-side price verification for all checkout operations. This involves retrieving the current product price from the database at the moment of order submission and comparing it against any client-supplied values, rejecting requests that do not match expected parameters. Implementing robust input validation frameworks and adopting a zero-trust approach to financial data handling will prevent similar logic flaws in future development cycles. Regular security audits focusing on e-commerce transaction flows are recommended to ensure continued resilience against business logic attacks.