CVE-2026-16620

Name of the Vulnerable Software and Affected Versions WPC Name Your Price for WooCommerce versions prior to 2.2.5

Description An issue exists where the plugin fails to enforce the server-side price allowlist for products configured in "Select" price mode. This allows an unauthenticated visitor to bypass validation and add a product to the cart at an arbitrary value below the merchant-defined allowed prices, potentially leading to revenue loss through underpriced orders. The flaw occurs because the system does not validate the submitted price against the allowed values list when the input type is set to select mode.

Recommendations Update WPC Name Your Price for WooCommerce to version 2.2.5 or later.