CVE-2026-94254: SellKit 2.3.5 - 2.7.0 - Unauthenticated Arbitrary Price Manipulation via 'sellkit_product_prices' Parameter
The SellKit WordPress plugin before 2.8.0 does not validate a client-supplied product price when totals are recalculated during checkout, allowing unauthenticated attackers to place orders for any purchasable product at a price of their own choosing.
Affected Software
Event History
Frequently Asked Questions
Who is exposed to this issue?
Sites using the SellKit WordPress plugin at a version before 2.8.0 are affected if they sell purchasable products through the vulnerable checkout flow.
Does an attacker need an account or special access?
No. The issue is exploitable by an unauthenticated attacker, so no login or privileged access is required.
What can an attacker do with this vulnerability?
An attacker can supply their own product price during checkout total recalculation and place an order for a purchasable product at a price they choose.
What version fixes the issue?
Upgrade SellKit to version 2.8.0 or later. Versions before 2.8.0 do not validate the client-supplied product price in the affected checkout calculation.