medium5.3
CVE-2026-85350
The UpsellWP WordPress plugin before 2.2.10 does not check that products added to the cart through a Frequently Bought Together campaign belong to that campaig…
Impact
The UpsellWP WordPress plugin before 2.2.10 does not check that products added to the cart through a Frequently Bought Together campaign belong to that campaign, allowing unauthenticated users to buy arbitrary products at the campaign's discounted price.
Affected products
| Product | Affected versions |
|---|---|
| UpsellWP WordPress Plugin | before 2.2.10 |
Versions were read from the advisory text. No structured product data has been published for this record yet.