CVE-2025-12115

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2025-12115", "assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "state": "PUBLISHED", "assignerShortName": "Wordfence", "dateReserved": "2025-10-23T15:27:17.832Z", "datePublished": "2025-10-31T09:27:21.530Z", "dateUpdated": "2026-04-08T17:33:31.563Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "shortName": "Wordfence", "dateUpdated": "2026-04-08T17:33:31.563Z"}, "affected": [{"vendor": "wpclever", "product": "WPC Name Your Price for WooCommerce", "versions": [{"version": "0", "status": "affected", "lessThanOrEqual": "2.1.9", "versionType": "semver"}], "defaultStatus": "unaffected"}], "descriptions": [{"lang": "en", "value": "The WPC Name Your Price for WooCommerce plugin for WordPress is vulnerable to unauthorized price alteration in all versions up to, and including, 2.1.9. This is due to the plugin not disabling the ability to name a custom price when it has been specifically disabled for a product. This makes it possible for unauthenticated attackers to purchase products at prices less than they should be able to."}], "title": "WPC Name Your Price for WooCommerce <= 2.1.9 - Unauthenticated Price Alteration", "references": [{"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/f64bc3c4-da89-4470-8353-d490f8bec408?source=cve"}, {"url": "https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3386310%40wpc-name-your-price&new=3386310%40wpc-name-your-price&sfp_email=&sfph_mail="}], "problemTypes": [{"descriptions": [{"lang": "en", "description": "CWE-602 Client-Side Enforcement of Server-Side Security", "cweId": "CWE-602", "type": "CWE"}]}], "metrics": [{"cvssV3_1": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N", "baseScore": 7.5, "baseSeverity": "HIGH"}}], "credits": [{"lang": "en", "type": "finder", "value": "Jonas Benjamin Friedli"}], "timeline": [{"time": "2025-10-29T02:26:02.000Z", "lang": "en", "value": "Vendor Notified"}, {"time": "2025-10-30T00:00:00.000Z", "lang": "en", "value": "Disclosed"}]}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2025-10-31T18:43:27.861884Z", "id": "CVE-2025-12115", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-10-31T18:43:39.464Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2025-12115", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2025-10-31T18:43:27.861884Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-10-31T18:43:33.665Z"}}], "cna": {"title": "WPC Name Your Price for WooCommerce <= 2.1.9 - Unauthenticated Price Alteration", "credits": [{"lang": "en", "type": "finder", "value": "Jonas Benjamin Friedli"}], "metrics": [{"cvssV3_1": {"version": "3.1", "baseScore": 7.5, "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N"}}], "affected": [{"vendor": "wpclever", "product": "WPC Name Your Price for WooCommerce", "versions": [{"status": "affected", "version": "*", "versionType": "semver", "lessThanOrEqual": "2.1.9"}], "defaultStatus": "unaffected"}], "timeline": [{"lang": "en", "time": "2025-10-29T02:26:02.000+00:00", "value": "Vendor Notified"}, {"lang": "en", "time": "2025-10-30T00:00:00.000+00:00", "value": "Disclosed"}], "references": [{"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/f64bc3c4-da89-4470-8353-d490f8bec408?source=cve"}, {"url": "https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3386310%40wpc-name-your-price&new=3386310%40wpc-name-your-price&sfp_email=&sfph_mail="}], "descriptions": [{"lang": "en", "value": "The WPC Name Your Price for WooCommerce plugin for WordPress is vulnerable to unauthorized price alteration in all versions up to, and including, 2.1.9. This is due to the plugin not disabling the ability to name a custom price when it has been specifically disabled for a product. This makes it possible for unauthenticated attackers to purchase products at prices less than they should be able to."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-602", "description": "CWE-602 Client-Side Enforcement of Server-Side Security"}]}], "providerMetadata": {"orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "shortName": "Wordfence", "dateUpdated": "2025-10-31T09:27:21.530Z"}}}, "cveMetadata": {"cveId": "CVE-2025-12115", "state": "PUBLISHED", "dateUpdated": "2025-10-31T18:43:39.464Z", "dateReserved": "2025-10-23T15:27:17.832Z", "assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "datePublished": "2025-10-31T09:27:21.530Z", "assignerShortName": "Wordfence"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "WPC Name Your Price for WooCommerce", "vendor": "wpclever", "versions": [{"lessThanOrEqual": "2.1.9", "status": "affected", "version": "0", "versionType": "semver"}]}], "source": "security@wordfence.com"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "The WPC Name Your Price for WooCommerce plugin for WordPress is vulnerable to unauthorized price alteration in all versions up to, and including, 2.1.9. This is due to the plugin not disabling the ability to name a custom price when it has been specifically disabled for a product. This makes it possible for unauthenticated attackers to purchase products at prices less than they should be able to."}, {"lang": "es", "value": "El plugin WPC Name Your Price for WooCommerce para WordPress es vulnerable a la alteraci\u00f3n no autorizada de precios en todas las versiones hasta la 2.1.9, inclusive. Esto se debe a que el plugin no deshabilita la capacidad de establecer un precio personalizado cuando esta ha sido espec\u00edficamente deshabilitada para un producto. Esto hace posible que atacantes no autenticados compren productos a precios inferiores a los que deber\u00edan poder."}], "id": "CVE-2025-12115", "lastModified": "2026-10-07T21:10:00.200", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 7.5, "baseSeverity": "HIGH", "confidentialityImpact": "NONE", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 3.6, "source": "security@wordfence.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2025-12115", "options": [{"exploitation": "none"}, {"automatable": "yes"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2025-10-31T18:43:27.861884Z", "version": "2.0.3"}}]}, "published": "2025-10-31T10:15:49.990", "references": [{"source": "security@wordfence.com", "url": "https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3386310%40wpc-name-your-price&new=3386310%40wpc-name-your-price&sfp_email=&sfph_mail="}, {"source": "security@wordfence.com", "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/f64bc3c4-da89-4470-8353-d490f8bec408?source=cve"}], "sourceIdentifier": "security@wordfence.com", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-602"}], "source": "security@wordfence.com", "type": "Secondary"}]}

{}

{"analysis": {"en": {"generated_at": "2026-04-21T01:59:40.140560+00:00", "value": {"mitigation_remediation": ["Upgrade WPC Name Your Price for WooCommerce to version 2.2 or later. ", "If an immediate upgrade is not possible, disable the \"Name Your Price\" feature for all products or replace the plugin entirely. ", "Monitor transactions for unusually low prices and configure alerts to detect potential unauthorized purchases."], "summary": {"action": "Apply patch immediately", "impact": "Unauthenticated price manipulation"}, "threat_synthesis": {"affected_systems": "WordPress sites using the WPC Name Your Price for WooCommerce plugin version 2.1.9 or earlier are affected; all releases up to and including 2.1.9 contain the vulnerability, while newer versions have the issue resolved.", "description_and_impact": "The WPC Name Your Price for WooCommerce plugin contains a flaw that allows unauthenticated users to set a custom price for products even when the feature has been disabled for those products. This leads to customers purchasing items at lower prices than intended, resulting in direct revenue loss and potential erosion of trust in the merchant\u2019s pricing integrity. The weakness aligns with CWE\u2011602, where the plugin improperly permits the use of a function that should have been denied.", "risk_and_exploitability": "The vulnerability has a CVSS score of 7.5, indicating high severity, but the EPSS score of <1% suggests a low likelihood of exploitation in the wild at this time. The attacker can trigger the flaw by submitting a purchase request without authentication, and no additional privileges or remote code execution are required. Although it is not listed in the CISA KEV catalog, e\u2011commerce operators should treat it as a critical issue for any site that utilizes the plugin."}}}}, "created": "2025-11-03T10:45:06.924525+00:00", "updated": "2026-04-21T02:00:12.333045+00:00", "vendors": ["woocommerce", "woocommerce$PRODUCT$woocommerce", "wordpress", "wordpress$PRODUCT$wordpress", "wpclever", "wpclever$PRODUCT$wpc_name_your_price_for_woocommerce"]}