CVE-2026-110364: WooCommerce Calculator Auth Bypass Flaw

CVE-2026-110364 Overview

CVE-2026-110364 is a Missing Authorization vulnerability [CWE-862] in the WP Desk Flexible Quantity – Measurement Price Calculator for WooCommerce plugin. The flaw affects all plugin versions from the earliest release through 2.3.23. Attackers can exploit incorrectly configured access control security levels to interact with plugin functionality that should require elevated privileges. The vulnerability is remotely exploitable over the network, requires no authentication, and needs no user interaction. Successful exploitation leads to limited integrity impact on affected WooCommerce stores.

Critical Impact

Unauthenticated remote attackers can modify plugin-controlled state on vulnerable WooCommerce stores running the Flexible Quantity plugin through version 2.3.23.

Affected Products

• WP Desk Flexible Quantity – Measurement Price Calculator for WooCommerce (plugin slug: flexible-quantity-measurement-price-calculator-for-woocommerce)
• All versions from initial release through 2.3.23
• WordPress sites running WooCommerce with the affected plugin installed

Discovery Timeline

• 2026-10-15 - CVE CVE-2026-110364 published to NVD
• 2026-10-15 - Last updated in NVD database

Technical Details for CVE-2026-110364

Vulnerability Analysis

The vulnerability is classified under CWE-862: Missing Authorization. The plugin exposes one or more actions that fail to verify whether the requesting user holds the capability required to perform them. An unauthenticated attacker can reach these endpoints directly over HTTP and trigger operations intended for privileged users. The attack vector is network-based with low complexity and no privileges required.

Impact is limited to integrity. Attackers cannot directly extract confidential data or crash the host through this flaw, but they can alter plugin-controlled values. In a WooCommerce context, this can affect price calculator configuration, measurement units, or product pricing modifiers that influence checkout behavior.

Root Cause

The plugin registers request handlers (such as AJAX actions or REST endpoints) without performing an authorization check. The code likely omits a current_user_can() capability check, a valid nonce verification through check_ajax_referer(), or both. As a result, the access control decision is effectively absent, and any unauthenticated HTTP client that knows the action name can invoke the handler.

Attack Vector

Exploitation requires only network reachability to the WordPress site. An attacker sends crafted HTTP POST or GET requests to wp-admin/admin-ajax.php or the plugin's registered REST route, naming the vulnerable action. Because no privilege gate exists, the handler executes server-side logic and returns a response. See the Patchstack Vulnerability Report for additional technical context.

Detection Methods for CVE-2026-110364

Indicators of Compromise

• Unauthenticated POST requests to /wp-admin/admin-ajax.php referencing plugin-specific action names tied to flexible-quantity-measurement-price-calculator-for-woocommerce.
• Unexpected modifications to WooCommerce product pricing rules, measurement configurations, or calculator settings that cannot be attributed to a logged-in administrator.
• Repeated requests from a single IP enumerating action= parameters against admin-ajax.php.

Detection Strategies

• Review WordPress and web server access logs for anonymous requests to plugin AJAX or REST endpoints and correlate against the user session or absence thereof.
• Deploy a Web Application Firewall rule to log and alert on admin-ajax.php traffic with no authenticated cookie that targets plugin actions.
• Compare current plugin configuration and WooCommerce product metadata against a known-good baseline to surface unauthorized changes.

Monitoring Recommendations

• Enable WordPress audit logging to capture configuration and option changes attributable to the vulnerable plugin.
• Monitor outbound order and pricing anomalies in WooCommerce reports that may indicate manipulation of calculator inputs.
• Alert on administrative option updates (update_option) performed outside of authenticated admin sessions.

How to Mitigate CVE-2026-110364

Immediate Actions Required

• Identify all WordPress sites running flexible-quantity-measurement-price-calculator-for-woocommerce version 2.3.23 or earlier.
• Apply the vendor patch as soon as a fixed version is published by WP Desk; monitor the Patchstack advisory for fix availability.
• Audit WooCommerce product pricing, measurement units, and calculator configurations for unauthorized changes.

Patch Information

The vulnerability affects the plugin from initial release through version 2.3.23. At the time of CVE publication on 2026-10-15, administrators should update to the latest version released by WP Desk that addresses this issue. Consult the vendor plugin page and the Patchstack advisory linked above for the fixed version identifier.

Workarounds

• Temporarily deactivate the Flexible Quantity – Measurement Price Calculator plugin until a patched release is installed.
• Restrict access to wp-admin/admin-ajax.php and plugin REST routes from untrusted networks using a Web Application Firewall or reverse proxy ACL.
• Enforce authentication at the edge for plugin-specific action names until the vendor patch is applied.

# Example WAF rule concept to block unauthenticated requests
# targeting the vulnerable plugin's AJAX actions
SecRule REQUEST_URI "@contains /wp-admin/admin-ajax.php" \
  "chain,deny,status:403,id:1026110364,msg:'CVE-2026-110364 block'"
  SecRule ARGS:action "@beginsWith wc_measurement_price_calculator" \
    "chain"
    SecRule &REQUEST_COOKIES:wordpress_logged_in "@eq 0"