The plugin fails to validate a client‑supplied product price when totals are recalculated during checkout, constituting a missing authorization flaw (CWE‑862). As a result, an unauthenticated attacker can submit a request that sets any desired price for a purchasable item, triggering the system to accept the customized amount and complete payment. The impact is a financial loss for the store operator and potential misuse of the ordering system, as the attacker can pay with a lower amount than the true product cost or potentially circumvent pricing constraints.

SellKit WordPress plugin versions 2.3.5 through 2.7.0, or any instance before 2.8.0, are affected. Users running those releases on any WordPress installation should be aware of the issue.

The EPSS score is under 1 %, indicating a relatively low probability of exploitation, and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog. Despite the low likelihood, the missing authorization flaw (CWE‑862) enables an unauthenticated attacker to manipulate transaction amounts, so the financial damage could be significant. The attack vector is inferred to be a network‑based request to the checkout endpoint that contains the 'sellkit_product_prices' parameter with an arbitrary value, bypassing server‑side price verification.