vulnerability
WordPress Plugin: wpc-name-your-price: CVE-2025-12115: Client-Side Enforcement of Server-Side Security
| Severity | CVSS | Published | Added | Modified |
|---|---|---|---|---|
| 8 | (AV:N/AC:L/Au:N/C:N/I:C/A:N) | Oct 30, 2025 | Oct 31, 2025 | Nov 3, 2025 |
Severity
8
CVSS
(AV:N/AC:L/Au:N/C:N/I:C/A:N)
Published
Oct 30, 2025
Added
Oct 31, 2025
Modified
Nov 3, 2025
Description
The WPC Name Your Price for WooCommerce plugin for WordPress is vulnerable to unauthorized price alteration in all versions up to, and including, 2.1.9. This is due to the plugin not disabling the ability to name a custom price when it has been specifically disabled for a product. This makes it possible for unauthenticated attackers to purchase products at prices less than they should be able to.
Solution
wpc-name-your-price-plugin-cve-2025-12115
NEW
Explore Exposure Command
Confidently identify and prioritize exposures from endpoint to cloud with full attack surface visibility and threat-aware risk context.