The WPC Name Your Price for WooCommerce plugin contains a flaw that allows unauthenticated users to set a custom price for products even when the feature has been disabled for those products. This leads to customers purchasing items at lower prices than intended, resulting in direct revenue loss and potential erosion of trust in the merchant’s pricing integrity. The weakness aligns with CWE‑602, where the plugin improperly permits the use of a function that should have been denied.

WordPress sites using the WPC Name Your Price for WooCommerce plugin version 2.1.9 or earlier are affected; all releases up to and including 2.1.9 contain the vulnerability, while newer versions have the issue resolved.

The vulnerability has a CVSS score of 7.5, indicating high severity, but the EPSS score of <1% suggests a low likelihood of exploitation in the wild at this time. The attacker can trigger the flaw by submitting a purchase request without authentication, and no additional privileges or remote code execution are required. Although it is not listed in the CISA KEV catalog, e‑commerce operators should treat it as a critical issue for any site that utilizes the plugin.