CVE-2026-85350 — UpsellWP < 2.2.10 - Unauthenticated Price Manipulation via Frequently Bought Together

CVE-2026-85350

UpsellWP < 2.2.10 - Unauthenticated Price Manipulation via Frequently Bought Together PUBLISHED

Description (CNA)

The UpsellWP WordPress plugin before 2.2.10 does not check that products added to the cart through a Frequently Bought Together campaign belong to that campaign, allowing unauthenticated users to buy arbitrary products at the campaign's discounted price.

Affected (CNA)

Vendor / product	Versions
Unknown / UpsellWP	affected 1.4.4 before 2.2.10

CWE

No CWE identifiers supplied.

References

https://wpscan.com/vulnerability/5068ff54-8632-42bd-b50a-4ecb6ac5853f/

ADP enrichment

CISA-ADP

No English description supplied.

No references supplied.