CVE-2025-12115

The WPC Name Your Price for WooCommerce plugin for WordPress is vulnerable to unauthorized price alteration in all versions up to, and including, 2.1.9. This is due to the plugin not disabling the ability to name a custom price when it has been specifically disabled for a product. This makes it possible for unauthenticated attackers to purchase products at prices less than they should be able to.

CVSS v3 7.5 HIGH

7.5^/10

CVSS v3 : HIGH

Vector :

Exploitability : 3.9 / Impact : 3.6

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact NONE

Integrity Impact HIGH

Availability Impact NONE

Scope UNCHANGED

References

Link	Resource
https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3386310%40wpc-name-your-price&new=3386310%40wpc-name-your-price&sfp_email=&sfph_mail=
https://www.wordfence.com/threat-intel/vulnerabilities/id/f64bc3c4-da89-4470-8353-d490f8bec408?source=cve

Configurations

No configuration.

History

07 Oct 2026, 21:10

Type	Values Removed	Values Added
Summary		(es) El plugin WPC Name Your Price for WooCommerce para WordPress es vulnerable a la alteración no autorizada de precios en todas las versiones hasta la 2.1.9, inclusive. Esto se debe a que el plugin no deshabilita la capacidad de establecer un precio personalizado cuando esta ha sido específicamente deshabilitada para un producto. Esto hace posible que atacantes no autenticados compren productos a precios inferiores a los que deberían poder.

Information

Published : 2025-10-31 10:15

Updated : 2026-10-07 21:10

NVD link : CVE-2025-12115

Mitre link : CVE-2025-12115

CVE.ORG link : CVE-2025-12115

JSON object : View

Products Affected

No product.

CWE

CWE-602

Client-Side Enforcement of Server-Side Security

{"id": "CVE-2025-12115", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2025-12115", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "yes"}, {"technicalImpact": "partial"}], "version": "2.0.3", "timestamp": "2025-10-31T18:43:27.861884Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "security@wordfence.com", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.5, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "NONE"}, "impactScore": 3.6, "exploitabilityScore": 3.9}]}, "affected": [{"source": "security@wordfence.com", "affectedData": [{"vendor": "wpclever", "product": "WPC Name Your Price for WooCommerce", "versions": [{"status": "affected", "version": "0", "versionType": "semver", "lessThanOrEqual": "2.1.9"}], "defaultStatus": "unaffected"}]}], "published": "2025-10-31T10:15:49.990", "references": [{"url": "https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3386310%40wpc-name-your-price&new=3386310%40wpc-name-your-price&sfp_email=&sfph_mail=", "source": "security@wordfence.com"}, {"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/f64bc3c4-da89-4470-8353-d490f8bec408?source=cve", "source": "security@wordfence.com"}], "vulnStatus": "Deferred", "weaknesses": [{"type": "Secondary", "source": "security@wordfence.com", "description": [{"lang": "en", "value": "CWE-602"}]}], "descriptions": [{"lang": "en", "value": "The WPC Name Your Price for WooCommerce plugin for WordPress is vulnerable to unauthorized price alteration in all versions up to, and including, 2.1.9. This is due to the plugin not disabling the ability to name a custom price when it has been specifically disabled for a product. This makes it possible for unauthenticated attackers to purchase products at prices less than they should be able to."}, {"lang": "es", "value": "El plugin WPC Name Your Price for WooCommerce para WordPress es vulnerable a la alteraci\u00f3n no autorizada de precios en todas las versiones hasta la 2.1.9, inclusive. Esto se debe a que el plugin no deshabilita la capacidad de establecer un precio personalizado cuando esta ha sido espec\u00edficamente deshabilitada para un producto. Esto hace posible que atacantes no autenticados compren productos a precios inferiores a los que deber\u00edan poder."}], "lastModified": "2026-10-07T21:10:00.200", "sourceIdentifier": "security@wordfence.com"}