CVE-2026-49110 Overview
CVE-2026-49110 is a broken authentication vulnerability in the Upsell Order Bump Offer for WooCommerce WordPress plugin, affecting versions up to and including 3.1.4. The flaw allows unauthenticated remote attackers to manipulate order pricing during checkout without valid authentication. Patchstack classifies the issue as a price manipulation vulnerability mapped to [CWE-1284] (Improper Validation of Specified Quantity in Input). The vulnerability impacts integrity of WooCommerce transactions on affected stores. No public exploit code, CISA KEV entry, or active exploitation has been reported as of publication.
Critical Impact
Unauthenticated attackers can manipulate order bump pricing in WooCommerce checkouts, enabling fraudulent purchases at attacker-controlled prices and direct revenue loss for affected merchants.
Affected Products
- Upsell Order Bump Offer for WooCommerce plugin versions <= 3.1.4
- WordPress sites running WooCommerce with the affected plugin installed
- E-commerce environments accepting orders through impacted checkout flows
Discovery Timeline
- 2026-06-15 - CVE-2026-49110 published to the National Vulnerability Database
- 2026-06-17 - Last updated in NVD database
Technical Details for CVE-2026-49110
Vulnerability Analysis
The Upsell Order Bump Offer for WooCommerce plugin extends WooCommerce checkouts with secondary offers presented to buyers before order completion. The plugin accepts pricing-related parameters from client-side input during the bump offer flow. Versions through 3.1.4 fail to validate that these inputs match server-side product definitions. Attackers can submit modified values and have the plugin honor them as legitimate prices.
The vulnerability is categorized as broken authentication because the affected order workflow does not require an authenticated session and does not enforce a trusted server-side authority over the order amount. The Patchstack advisory describes the impact as price manipulation, meaning an attacker can purchase bump offers at amounts below the merchant-configured price. The integrity impact is high; confidentiality and availability are not affected.
Root Cause
The root cause is improper validation of a quantity- or price-bearing input field [CWE-1284]. The plugin trusts client-supplied checkout parameters instead of recomputing the bump offer price from authoritative WooCommerce product records on the server. No authentication or capability check gates the request path that consumes this input.
Attack Vector
Exploitation occurs over the network without authentication or user interaction. An attacker initiates a normal WooCommerce checkout that includes a bump offer, intercepts the HTTP request, and substitutes the price field with an arbitrary value before submission. The plugin processes the order using the attacker-supplied amount. No special privileges, tokens, or prior account access are required. Refer to the Patchstack Vulnerability Report for additional technical context.
Detection Methods for CVE-2026-49110
Indicators of Compromise
- WooCommerce orders containing bump offer line items priced significantly below the configured plugin price
- HTTP POST requests to WooCommerce checkout endpoints with anomalous numeric values in price or amount parameters
- Repeated checkout submissions from a single IP address against the same bump offer product
- Unusually high conversion rates on bump offers paired with low average order values
Detection Strategies
- Reconcile completed WooCommerce order totals against authoritative product price records and alert on negative deltas
- Inspect web server and WAF logs for checkout POST requests where price-related fields fall outside expected bounds
- Enable WooCommerce order auditing and review historical orders processed by the plugin since installation of any version <= 3.1.4
Monitoring Recommendations
- Forward WordPress, WooCommerce, and web server access logs to a centralized SIEM or data lake for correlation
- Build alerts on order totals that diverge from product catalog pricing by more than a configured threshold
- Monitor for installation or activation of the Upsell Order Bump Offer for WooCommerce plugin across managed WordPress estates
How to Mitigate CVE-2026-49110
Immediate Actions Required
- Update the Upsell Order Bump Offer for WooCommerce plugin to a version above 3.1.4 once released by the vendor
- Audit completed orders for fraudulent pricing and initiate refunds or chargebacks where merchant losses are identified
- Deactivate the plugin on production WooCommerce stores if a fixed version is not yet available
Patch Information
The Patchstack advisory tracks the fixed version for this issue. Administrators should consult the Patchstack Vulnerability Report for the patched release version and apply it through the WordPress plugin updater or via WP-CLI.
Workarounds
- Disable the bump offer functionality at the plugin settings level until a patched version is installed
- Deploy a WAF rule that rejects checkout requests where bump offer price parameters do not match server-side product values
- Restrict access to WooCommerce checkout endpoints from known-bad IP ranges and enforce rate limiting on checkout submissions
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
