Vulnerability in SellKit WordPress Plugin Allows Price Manipulation
CVE-2026-94254
Currently unrated
Key Information:
Badges
👾 Exploit Exists🟡 Public PoC
What is CVE-2026-94254?
The SellKit plugin for WordPress, prior to version 2.8.0, contains a significant vulnerability that fails to properly validate the price input supplied by users. This weakness permits unauthenticated attackers to manipulate product prices during the checkout process. As a result, attackers can place orders for any available product at arbitrary prices, potentially leading to financial losses and unauthorized transactions for vendors using this plugin. It is crucial for users to update to the latest version to mitigate this risk.
Affected Version(s)
SellKit 2.3.5 < 2.8.0
Exploit Proof of Concept (PoC)
PoC code is written by security researchers to demonstrate the vulnerability can be exploited. PoC code is also a key component for weaponization which could lead to ransomware.