Security Alert Summary
The StoreGrowth WordPress plugin contains a price validation flaw in versions before 2.1.2. Two unauthenticated actions accept a browser-supplied product price without proper validation, allowing an attacker to add a product to the cart at an arbitrary price that can carry through to the checkout total when the BOGO offer feature is enabled.
CVE Details
- CVE ID: CVE-2026-78137
- Affected component: StoreGrowth WordPress plugin
- Affected versions: Versions before 2.1.2 (less than 2.1.2)
- Published: August 27, 2026 at 6:17:29 AM
- Last modified: August 27, 2026 at 6:17:29 AM
- CVSS v3.1: Not provided in the CVE data
- Authentication required: None – unauthenticated actions are affected
- Privileges required: None
- User interaction: Not required for the vulnerable actions described
- Primary impact:
- Confidentiality: Not indicated by the provided data
- Integrity: Allows attacker-controlled price values to be applied, impacting transactional integrity
- Availability: Not indicated by the provided data
- CWE / weakness ID: Not specified
Technical Details
The plugin fails to validate a browser-supplied product price on two of its unauthenticated actions. Because these actions do not perform adequate server-side validation, an attacker can submit an arbitrary price value which the plugin accepts and uses when adding a product to the cart. When the BOGO (buy-one-get-one) offer feature is enabled, the manipulated price can carry through to the checkout total.
The description identifies the issue as a lack of validation on unauthenticated actions. No specific function names or REST API endpoints are provided in the CVE data. The core issue is missing or insufficient server-side price validation for inputs that influence cart and checkout calculations.
Impact is limited to manipulation of pricing values handled by the affected actions. The vulnerability does not, based on the provided data, indicate remote code execution, privilege escalation, or direct data disclosure beyond what price manipulation could cause in transactions.
How This Could Impact Your Website
Consider a typical small site workflow: a site owner configures the store and enables BOGO offers, an internal staff member manages products and promotions, and an external contractor or contributor helps with marketing. An attacker who can add items to the cart with attacker-chosen prices could:
- Cause incorrect checkout totals that lead to financial loss or reconciliation issues for the store owner.
- Create confusing or fraudulent orders that require staff time to investigate and resolve.
- Potentially be combined with other weaknesses to aid targeted social engineering; for example, manipulated transactions or order notifications could be used to craft believable phishing lures. The CVE data does not state direct data disclosure of user emails, but manipulation of transactional workflows can increase the risk of follow-on social engineering attacks.
If you’re unsure whether your site is affected or how to assess your current user roles and plugins, it may be worth having a professional review.
Recommended Actions
- Update the affected plugin as soon as a patched version is available.
- Review and reduce unnecessary user roles, especially contributor-level accounts that can interact with product or cart functionality.
- Enforce strong passwords and two-factor authentication for editors and administrators.
- Remove unused or unmaintained plugins from the site.
- Monitor site activity and order logs for unusual behavior, such as unexpected price values or atypical checkout totals.
If you’d like help reviewing your plugins, user roles, or overall WordPress security posture, our team at Freshy is happy to help.
