Is CVE-2026-106605 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-106605 being exploited in the wild.

How severe is CVE-2026-106605?

Medium severity, with a CVSS score of 5.3, published 12 October 2026.

Is there a fix for CVE-2026-106605?

Yes: fixed in 2.3.23. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-106605 attacked?

It is attacked over the network, in a web application.

Am I affected by CVE-2026-106605?

Check whether you run WP Desk Flexible Quantity – Measurement Price Calculator for WooCommerce at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-106605: WP Desk Flexible Quantity Calculator improper input validation

CVE-2026-106605 · Severity: medium · CVSS 5.3 · Published 2026-10-12

The Flexible Quantity – Measurement Price Calculator plugin for WooCommerce is a tool that allows e-commerce stores to accept custom product quantities and pricing based on measurements. An improper input validation flaw permits attackers to manipulate quantity data without authentication, potentially leading to incorrect pricing, inventory bypasses, or fraudulent transactions.

Technologies: WP Desk Flexible Quantity – Measurement Price Calculator for WooCommerce. Vendors: WP Desk.

Quick answers

Is CVE-2026-106605 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-106605 being exploited in the wild.
How severe is CVE-2026-106605?: Medium severity, with a CVSS score of 5.3, published 12 October 2026.
Which products and versions are affected?: WP Desk Flexible Quantity – Measurement Price Calculator for WooCommerce through 2.3.22.
Is there a fix for CVE-2026-106605?: Yes: fixed in 2.3.23. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-106605 attacked?: It is attacked over the network, in a web application.
Am I affected by CVE-2026-106605?: Check whether you run WP Desk Flexible Quantity – Measurement Price Calculator for WooCommerce at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

Fixed in: 2.3.23

Technical details

The plugin fails to properly validate quantity input from users, enabling input data manipulation attacks. An unauthenticated attacker can send crafted requests to modify quantity specifications, bypassing intended business logic. The vulnerability is classified as an improper design issue with low exploitability in practice.

Affected products

WP Desk Flexible Quantity – Measurement Price Calculator for WooCommerce through 2.3.22

Timeline

2026-09-30: disclosed
2026-10-12: advisory
2026-10-12: patched: version 2.3.23 released

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.