CVE-2026-106605

5.3Medium

Published 12 Oct 2026 · NVD status: Deferred · AI triage by gemini-3.8-flash

5.3Medium

Attack vector: Network
Complexity: Low
Privileges needed: None
User interaction: None
Impact: Limited impact
Weakness: CWE-1284

Impact

Remote, unauthenticated attackers can manipulate input data such as product order quantities. They only need network access to the WooCommerce store.

Root cause

The plugin improperly validates specified quantity inputs, allowing manipulation of order data.

Affected systems

Flexible Quantity – Measurement Price Calculator for WooCommerce through 2.3.22

CVSS v3.1 · CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N

Fix & remediation

Update the Flexible Quantity plugin to a version newer than 2.3.22, or deactivate the plugin until a patch is applied.

shell

$ wp plugin update flexible-quantity-measurement-price-calculator-for-woocommerce

AI-suggested. Run it in staging first and check it against the vendor advisory. Why?

Ad · In-content banner

NVD description

Improper Validation of Specified Quantity in Input vulnerability in WP Desk Flexible Quantity – Measurement Price Calculator for WooCommerce flexible-quantity-measurement-price-calculator-for-woocommerce allows Input Data Manipulation.This issue affects Flexible Quantity – Measurement Price Calculator for WooCommerce: from n/a through 2.3.22.

References

https://patchstack.com/database/wordpress/plugin/flexible-quantity-measurement-price-calculator-for-woocommerce/vulnerability/wordpress-flexible-quantity-measurement-price-calculator-for-woocommerce-plugin-2-3-22-other-vulnerability-type-vulnerability?_s_id=cve

Source: nvd.nist.gov/vuln/detail/CVE-2026-106605