Server-Side Price Enforcement Flaw in WPC Name Your Price for WooCommerce Plugin
CVE-2026-16620

7.5HIGH

Key Information:

Vendor

WordPress
Status
WPc Name Your Price For WooCommerce
Vendor
CVE Published:
6 August 2026

Badges

👾 Exploit Exists🟡 Public PoC

What is CVE-2026-16620?

The WPC Name Your Price for WooCommerce WordPress plugin, prior to version 2.2.5, is vulnerable due to inadequate server-side enforcement of price allowlists for products set to 'Select' price mode. This oversight allows unauthenticated users to manipulate product prices below the merchant's approved threshold. As a result, these users can place actual orders at these incorrectly set amounts, potentially leading to significant revenue losses for merchants due to underpriced transactions. This vulnerability operates independently of other reported issues, making it essential for website owners to apply the latest updates.

Affected Version(s)

WPC Name Your Price for WooCommerce 0 < 2.2.5

Exploit Proof of Concept (PoC)

PoC code is written by security researchers to demonstrate the vulnerability can be exploited. PoC code is also a key component for weaponization which could lead to ransomware.

CVE-2026-16620 - Proof of Concept

References

https://wpscan.com/vulnerability/71e6ccc0-5626-4cce-986e-...
exploitvdb-entrytechnical-description

CVSS V3.1

Score:
7.5
Severity:
HIGH
Confidentiality:
None
Integrity:
High
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • 🟡

    Public PoC available

  • 👾

    Exploit known to exist

  • Vulnerability published

  • Vulnerability Reserved

Credit

Muni Nitish Kumar Yaddala
WPScan
.