CVE-2026-49110: WordPress Upsell Order Bump Offer for WooCommerce plugin <= 3.1.4 - Price Manipulation vulnerability

Synopsis

This is a broken authentication vulnerability in the Upsell Order Bump Offer for WooCommerce WordPress plugin, affecting versions 3.1.4 and earlier. The flaw is reachable over the network with no authentication required and no user interaction needed, making it trivially exploitable by any remote attacker. Successful exploitation allows an attacker to manipulate product prices during checkout, directly tampering with order data. No fix has been published yet; HarborGuard tracks the advisory for patch availability.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The vulnerable plugin endpoint is exposed over the network, meaning any remote attacker who can reach the WooCommerce store can send a malicious request.

• AuthenticationNot required

  No account or credentials of any kind are needed; the vulnerability is exploitable by an anonymous, unauthenticated HTTP request.

• Victim interactionNot required

  The attacker does not need to trick or involve any user; the exploit is entirely server-side and requires no victim action.

• Attack complexityDetail

  Attack complexity is low, meaning the exploit is reliable and imposes no special conditions, race requirements, or environmental dependencies on the attacker.

Blast Radius

• An attacker can manipulate the price of upsell order bump items at checkout, paying less than the intended amount for products.
• Order integrity across any WooCommerce transaction that includes an upsell bump offer is undermined, affecting revenue and financial records.
• No confidential data is directly disclosed and no service disruption occurs, but persisted order rows in the database reflect the attacker-supplied, fraudulent pricing.