PPOM for WooCommerce <= 34.0.9 - Unauthenticated Price Manipulation via 'ppom_option_price' Parameter
- ID
- WPSEC-2026-0054
- Plugin
- PPOM – Product Addons & Custom Fields for WooCommerce (woocommerce-product-addon)
- Affected
- all versions before 34.0.10
- Remediation
- Update to 34.0.10 or later.
- CVSS 3.1
- CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
- Weakness
- CWE-472
- Usage
- Plugin Low · Affected versions Low among sites WPSec scans, 2026-10-22
- Attack surface
- PPOM for WooCommerce on WPSec AttackSurface
- Fix released
- Published
Description
The PPOM – Product Addons & Custom Fields for WooCommerce plugin for WordPress is vulnerable to price manipulation via the 'ppom[ppom_option_price]' parameter in all versions up to, and including, 34.0.9. This is due to the cart fee handler (CartHandler::add_fixed_fee, hooked to woocommerce_cart_calculate_fees) adding one-time (fixed) fees with the amounts taken directly from the client-submitted JSON, without re-deriving them from the saved field configuration or rejecting negative values. This makes it possible for unauthenticated attackers to submit arbitrary one-time fee amounts, including negative values that act as a discount, and so reduce the order total. This is only exploitable when the 'Enable Legacy Price Calculations' setting is enabled (it is off by default).
References
- https://wpsec.com/vuln/WPSEC-2026-0054/
- https://plugins.svn.wordpress.org/woocommerce-product-addon/tags/34.0.10/
- https://wordpress.org/plugins/woocommerce-product-addon/
Published by WPSec. Provided as is, without warranty. Corrections: contact us.
This advisory as JSON or Markdown · All advisories: JSON, RSS