high7.5
CVE-2026-78137
The StoreGrowth WordPress plugin before 2.1.2 does not validate a browser-supplied product price on two of its unauthenticated actions, allowing unauthenticate…
Impact
The StoreGrowth WordPress plugin before 2.1.2 does not validate a browser-supplied product price on two of its unauthenticated actions, allowing unauthenticated attackers to add a product to the cart at an arbitrary, attacker-chosen price that carries through to the checkout total when the BOGO offer feature is enabled.
Affected products
| Product | Affected versions |
|---|---|
| StoreGrowth WordPress Plugin | before 2.1.2 |
Versions were read from the advisory text. No structured product data has been published for this record yet.