The MinimogWP theme allows an unauthenticated attacker to manipulate the price of items in a WooCommerce cart by entering a fractional quantity value, because the theme does not perform a proper check on the quantity. This flaw permits attackers to add any product to the cart and change its quantity to a non‑integer, causing the total price to be recalculated based on that fractional amount. The result is unauthorized price manipulation, which could lead to losses through underpricing or overpricing without the site owner’s consent.

Any WordPress installation that uses MinimogWP – The High Converting eCommerce WordPress Theme version 3.9.0 or earlier is affected. The vulnerability only exists when the underlying WooCommerce plugin is older than version 9.8.2; sites running WooCommerce 9.8.2 or newer are immune even if the theme remains at a vulnerable version.

The flaw carries a CVSS score of 7.5, indicating a high severity risk, but the EPSS score of less than 1% shows that exploitation is unlikely at this time. The vulnerability is not listed in CISA’s KEV catalog. An attacker can exploit the issue from any publicly reachable WooCommerce site without authentication, simply by adding an item to the cart and setting a fractional quantity value. The exploit does not require privileged access, and the impact is limited to the manipulation of the cart price for the attacker’s benefit.