Price Manipulation Vulnerability in StoreGrowth Plugin for WordPress
CVE-2026-78137
Currently unrated
Key Information:
- Vendor
WordPress
- Status
- Vendor
- CVE Published:
- 27 August 2026
Badges
👾 Exploit Exists🟡 Public PoC
What is CVE-2026-78137?
The StoreGrowth WordPress plugin prior to version 2.1.2 is vulnerable due to insufficient validation of browser-supplied product prices on certain unauthenticated actions. This flaw permits attackers to specify arbitrary prices when adding products to the shopping cart, especially when the 'Buy One Get One' (BOGO) offer feature is activated. Exploitation of this vulnerability could lead to significant financial losses for merchants, as the manipulated price will be used during checkout.
Affected Version(s)
StoreGrowth 0 < 2.1.2
Exploit Proof of Concept (PoC)
PoC code is written by security researchers to demonstrate the vulnerability can be exploited. PoC code is also a key component for weaponization which could lead to ransomware.