CVE-2026-85350 Overview
CVE-2026-85350 is a business logic vulnerability in the UpsellWP WordPress plugin versions prior to 2.2.10. The plugin fails to validate that products added to the cart through a Frequently Bought Together (FBT) campaign actually belong to that campaign. Unauthenticated attackers can exploit this flaw to purchase arbitrary products at the campaign's discounted price. The issue is classified under [CWE-287] (Improper Authentication) and affects e-commerce sites relying on UpsellWP for upsell and cross-sell promotions.
Critical Impact
Unauthenticated attackers can purchase any product in the store at a promotional discount price by manipulating cart requests tied to Frequently Bought Together campaigns.
Affected Products
- UpsellWP WordPress plugin versions before 2.2.10
- WordPress installations running WooCommerce with UpsellWP FBT campaigns enabled
- E-commerce storefronts using UpsellWP promotional discount workflows
Discovery Timeline
- 2026-09-18 - CVE-2026-85350 published to the National Vulnerability Database
- 2026-09-18 - Last updated in NVD database
Technical Details for CVE-2026-85350
Vulnerability Analysis
The vulnerability is a business logic flaw in how UpsellWP validates cart additions from Frequently Bought Together (FBT) campaigns. When a shopper adds an FBT bundle to their cart, the plugin applies the campaign's promotional discount to the products in the request. However, the plugin does not verify that the requested products are actually members of the referenced campaign.
An attacker can therefore submit a cart request that references a valid FBT campaign identifier while substituting arbitrary product IDs. The plugin honors the substitution and applies the discounted campaign price to products the merchant never intended to discount. Because the endpoint is reachable without authentication, any visitor can trigger the flaw.
The integrity impact is limited to unauthorized discount application, not full compromise of the site. There is no direct confidentiality or availability impact from this flaw.
Root Cause
The root cause is a missing authorization check between the campaign context and the products being added to the cart. The plugin trusts the client-supplied product identifiers instead of cross-referencing them against the campaign's configured product list on the server side. This maps to [CWE-287] as classified in the NVD entry, reflecting the plugin's failure to properly bind campaign privileges to authorized items.
Attack Vector
Exploitation occurs over the network with low attack complexity and requires no privileges or user interaction. An attacker crafts a request to the plugin's add-to-cart handler that includes a legitimate FBT campaign reference alongside a product ID outside the campaign scope. The plugin computes the discounted price and adds the arbitrary product to the cart at that reduced price. The attacker completes checkout normally and pays the discounted amount. Refer to the WPScan Vulnerability Analysis for further technical detail.
Detection Methods for CVE-2026-85350
Indicators of Compromise
- Orders containing products at unexpectedly low unit prices matching an active FBT campaign discount amount.
- Cart or order records where line items reference an FBT campaign identifier but the product ID is not part of that campaign's configured bundle.
- Repeated add-to-cart requests from a single IP or session containing mismatched campaign and product identifiers.
Detection Strategies
- Audit WooCommerce order history for discounted line items that do not align with configured FBT campaign product lists.
- Compare stored campaign metadata against order line item metadata to identify unauthorized discount application.
- Instrument the plugin's cart endpoint with logging that records both campaign ID and product ID pairs for each add-to-cart request.
Monitoring Recommendations
- Enable web server access logs and forward them to a centralized log platform for retention and query.
- Alert on anomalous checkout patterns such as spikes in orders using a specific FBT campaign identifier.
- Monitor for revenue variance in reports where discount totals materially exceed expected campaign uptake.
How to Mitigate CVE-2026-85350
Immediate Actions Required
- Upgrade the UpsellWP plugin to version 2.2.10 or later on all WordPress installations.
- Review order history since the affected plugin version was installed for fraudulent discounted purchases.
- Cancel or reprice orders that contain products discounted outside their configured FBT campaign scope.
Patch Information
The vendor addressed the flaw in UpsellWP version 2.2.10 by validating that requested products belong to the referenced Frequently Bought Together campaign before applying the discount. Site administrators should apply this update through the WordPress plugin management interface. Additional details are available in the WPScan Vulnerability Analysis.
Workarounds
- Disable the UpsellWP plugin's Frequently Bought Together functionality until the patch is applied.
- Temporarily deactivate active FBT campaigns to prevent attackers from referencing valid campaign identifiers.
- Configure WooCommerce order review workflows to hold discounted orders for manual verification before fulfillment.
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.