CVE-2026-106605 Overview
CVE-2026-106605 is an improper input validation vulnerability in the WP Desk Flexible Quantity – Measurement Price Calculator for WooCommerce plugin. The flaw affects all plugin versions up to and including 2.3.22. An unauthenticated attacker can manipulate quantity input data submitted to the plugin, bypassing server-side validation of specified quantity values. The vulnerability is tracked under CWE-1284: Improper Validation of Specified Quantity in Input.
Critical Impact
Remote, unauthenticated attackers can tamper with product quantity inputs over the network, enabling integrity-affecting manipulation of WooCommerce order data without user interaction.
Affected Products
- WP Desk Flexible Quantity – Measurement Price Calculator for WooCommerce n/a through 2.3.22
- WordPress sites running the flexible-quantity-measurement-price-calculator-for-woocommerce plugin
- WooCommerce storefronts leveraging measurement-based price calculation
Discovery Timeline
- 2026-10-12 - CVE-2026-106605 published to NVD
- 2026-10-13 - Last updated in NVD database
Technical Details for CVE-2026-106605
Vulnerability Analysis
The plugin fails to properly validate the quantity values submitted through its measurement-based price calculator. WP Desk Flexible Quantity extends standard WooCommerce quantity handling with measurement units such as length, area, volume, and weight. The calculator accepts user-supplied numeric inputs that are then used to compute cart line totals. Because the plugin does not enforce correct bounds or type checks on these submitted quantities, attackers can supply values outside the intended range or format. The result is manipulation of downstream pricing or inventory logic without triggering plugin-level rejection.
Root Cause
The root cause maps to CWE-1284, Improper Validation of Specified Quantity in Input. The plugin trusts quantity parameters sent from the browser without re-validating ranges, decimals, or sign on the server. No authentication is required to reach the vulnerable code path, and no user interaction is needed beyond crafting a POST request to a WooCommerce endpoint handled by the plugin.
Attack Vector
The vulnerability is exploitable over the network against any public WooCommerce storefront with the plugin enabled. An attacker crafts HTTP requests to the add-to-cart or price calculation handler and substitutes manipulated quantity fields. See the Patchstack Vulnerability Report for additional technical context. No proof-of-concept code or in-the-wild exploitation has been published.
Detection Methods for CVE-2026-106605
Indicators of Compromise
- Unusual WooCommerce order lines with negative, zero, fractional, or extreme quantity values tied to measurement-priced products.
- Cart totals that do not match expected quantity × unit price arithmetic for measurement-calculated items.
- Repeated POST requests to WooCommerce add-to-cart endpoints with non-standard quantity parameters from a single source IP.
Detection Strategies
- Audit WooCommerce order history for completed transactions where the final price is inconsistent with the configured measurement pricing rules.
- Enable verbose logging on the WordPress reverse proxy or Web Application Firewall to capture add-to-cart request bodies for review.
- Correlate anomalous order values with the plugin version to confirm exposure to versions through 2.3.22.
Monitoring Recommendations
- Monitor WooCommerce database tables such as wp_woocommerce_order_items and wp_woocommerce_order_itemmeta for implausible quantity metadata.
- Alert on bulk order creation activity targeting products managed by the Flexible Quantity plugin.
- Track plugin version inventory across WordPress estates to identify hosts still running vulnerable builds.
How to Mitigate CVE-2026-106605
Immediate Actions Required
- Identify all WordPress sites running flexible-quantity-measurement-price-calculator-for-woocommerce version 2.3.22 or earlier.
- Upgrade to a fixed release once published by WP Desk, as referenced in the Patchstack advisory.
- Review recent orders for pricing anomalies on products using the measurement calculator and reconcile against expected revenue.
Patch Information
At the time of publication, the NVD entry lists affected versions from n/a through 2.3.22. Administrators should consult the Patchstack Vulnerability Report for the latest fixed version information from WP Desk.
Workarounds
- Temporarily disable the Flexible Quantity plugin on affected stores until a patched version is deployed.
- Add Web Application Firewall rules that enforce minimum, maximum, and numeric type constraints on quantity parameters submitted to WooCommerce endpoints.
- Restrict access to the storefront with rate limiting to reduce the feasibility of automated quantity-tampering attempts.
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
