CVE-2025-12115: WPC Name Your Price Auth Bypass Flaw

CVE-2025-12115 Overview

The WPC Name Your Price for WooCommerce plugin for WordPress contains an unauthorized price alteration vulnerability affecting all versions up to and including 2.1.9. The vulnerability stems from improper enforcement of price restrictions, allowing attackers to bypass product-specific pricing controls and purchase items at arbitrary prices.

Critical Impact

Unauthenticated attackers can exploit this vulnerability to purchase products at prices significantly lower than intended, potentially causing substantial financial losses for e-commerce businesses using the affected plugin.

Affected Products

• WPC Name Your Price for WooCommerce plugin versions ≤ 2.1.9
• WordPress installations running the vulnerable plugin versions
• WooCommerce stores with custom pricing features enabled

Discovery Timeline

• 2025-10-31 - CVE CVE-2025-12115 published to NVD
• 2026-04-15 - Last updated in NVD database

Technical Details for CVE-2025-12115

Vulnerability Analysis

This vulnerability is classified as CWE-602 (Client-Side Enforcement of Server-Side Security), indicating a fundamental flaw in the security architecture of the plugin. The WPC Name Your Price for WooCommerce plugin provides store administrators with the ability to allow customers to name their own price for specific products. However, a critical oversight in the implementation allows the custom pricing functionality to remain active even when administrators have explicitly disabled it for particular products.

The vulnerability can be exploited remotely without any authentication, meaning any visitor to the affected WooCommerce store can potentially manipulate product prices. The impact is primarily on the integrity of pricing data and transactions, allowing unauthorized modification of purchase amounts without affecting confidentiality or availability of the system.

Root Cause

The root cause of CVE-2025-12115 lies in the plugin's failure to properly validate server-side whether the "Name Your Price" feature is enabled for a specific product before accepting custom price inputs. The plugin relies on client-side controls to disable the pricing input field when the feature is turned off for a product, but fails to implement corresponding server-side validation. This allows attackers to bypass the client-side restrictions by directly submitting modified price values through crafted requests.

Attack Vector

The attack can be executed over the network by any unauthenticated user. An attacker identifies products on a vulnerable WooCommerce store and crafts requests that include custom price parameters, regardless of whether the "Name Your Price" feature is enabled for those products. Since the server does not validate whether custom pricing should be allowed, the attacker-supplied price is accepted, enabling purchases at unauthorized discounts.

The exploitation involves intercepting or crafting the add-to-cart or checkout requests and modifying the price parameter to an arbitrary value. This could be accomplished using browser developer tools, proxy tools, or automated scripts. The attack requires no special privileges or user interaction, making it highly accessible to potential attackers.

Detection Methods for CVE-2025-12115

Indicators of Compromise

• Unusual order patterns with abnormally low prices on products that should not support custom pricing
• Multiple orders from the same customer or IP address with significantly discounted prices
• Transaction logs showing price modifications for products with "Name Your Price" feature disabled
• Cart and checkout requests containing custom price parameters for non-eligible products

Detection Strategies

• Review WooCommerce order histories for transactions with prices significantly below product list prices
• Implement server-side logging of all price-related parameters submitted during checkout
• Configure web application firewall rules to flag requests with unexpected pricing parameters
• Set up alerts for orders where the final price differs substantially from the expected product price

Monitoring Recommendations

• Monitor plugin version and ensure automatic updates are enabled for the WPC Name Your Price plugin
• Establish baseline pricing analytics to detect anomalous purchasing patterns
• Review access logs for unusual POST request patterns targeting WooCommerce cart and checkout endpoints
• Implement real-time transaction monitoring to flag suspicious pricing discrepancies

How to Mitigate CVE-2025-12115

Immediate Actions Required

• Update the WPC Name Your Price for WooCommerce plugin to the latest version immediately
• Audit recent orders for potential exploitation, particularly orders with prices below expected values
• Temporarily disable the WPC Name Your Price plugin if an update is not immediately available
• Review and reconcile any orders that may have been placed at unauthorized prices

Patch Information

The vulnerability has been addressed in versions released after 2.1.9. Administrators should update to the latest available version of the WPC Name Your Price for WooCommerce plugin. The fix implements proper server-side validation to ensure that custom pricing is only accepted for products where the feature has been explicitly enabled by the administrator. Technical details of the patch can be found in the WordPress Plugin Changeset. Additional vulnerability analysis is available from Wordfence Vulnerability Analysis.

Workarounds

• Disable the WPC Name Your Price for WooCommerce plugin until the patch can be applied
• Implement a web application firewall rule to block or inspect requests containing custom price parameters
• Add server-side validation at the theme or custom plugin level to verify pricing integrity before order completion
• Consider temporarily switching to manual order review for all purchases until the vulnerability is patched

# WordPress CLI command to update the plugin
wp plugin update wpc-name-your-price --path=/var/www/html

# Verify the current plugin version
wp plugin list --path=/var/www/html | grep wpc-name-your-price

# Temporarily deactivate the plugin if update is not available
wp plugin deactivate wpc-name-your-price --path=/var/www/html