CVE-2026-115601: WordPress Custom Price for WooCommerce plugin <= 1.1.29 - Broken Access Control vulnerability

Q: Which installations are affected?

Custom Price for WooCommerce versions through 1.1.29 are affected. The available data does not identify an unaffected fixed version.

Q: Can this be exploited remotely without an account or user interaction?

Yes. The supplied CVSS vector indicates network-based exploitation with low attack complexity, no privileges required, and no user interaction required.

Q: What is the expected impact of successful exploitation?

The supplied CVSS vector indicates integrity impact only; confidentiality and availability impacts are listed as none.

Published Oct 29, 2026

Updated

Missing Authorization vulnerability in WP Desk Custom Price for WooCommerce custom-price-for-woocommerce allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Custom Price for WooCommerce: from n/a through 1.1.29.

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade wordpress/custom-price-for-woocommerce to a version that resolves this vulnerability.
Fixed in 1.1.30

Event History

Oct 29, 2026

CVE Published

via MITRE·02:31 PM

Data Sourced

via MITRE·02:31 PM

RemedyDescriptionSeverityWeakness

Data Sourced

via NVD·03:17 PM

DescriptionSeverityWeakness

Frequently Asked Questions

Which installations are affected?

Custom Price for WooCommerce versions through 1.1.29 are affected. The available data does not identify an unaffected fixed version.

Can this be exploited remotely without an account or user interaction?

Yes. The supplied CVSS vector indicates network-based exploitation with low attack complexity, no privileges required, and no user interaction required.

What is the expected impact of successful exploitation?