CVE-2025-12115
WPC Name Your Price for WooCommerce <= 2.1.9 - Unauthenticated Price Alteration
- State
- Published
- Severity
- 7.5 High
- Published
- Oct 31, 2025
- Updated
- Apr 8, 2026
- Reserved
- Oct 23, 2025
Description
The WPC Name Your Price for WooCommerce plugin for WordPress is vulnerable to unauthorized price alteration in all versions up to, and including, 2.1.9. This is due to the plugin not disabling the ability to name a custom price when it has been specifically disabled for a product. This makes it possible for unauthenticated attackers to purchase products at prices less than they should be able to.
Scores
| CVSS | Score | Vector | Source |
|---|---|---|---|
| 3.1 | 7.5 High | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N | Wordfence |
Weaknesses
- CWE-602 Client-Side Enforcement of Server-Side Security
Affected Products
| Product | Versions |
|---|---|
WPC Name Your Price for WooCommercewpclever |
|
References
Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.