# CVE-2026-106605: WP Desk Flexible Quantity Calculator improper input validation

Source: https://junglewise.ai/threats/cve-2026-106605-improper-validation-of-specified-quantity-in-input-vulnerability  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-10-12. Updated: 2026-10-16  
License: CC BY 4.0 with a link back

CVE-2026-106605 · Severity: medium · CVSS 5.3 · Published 2026-10-12

The Flexible Quantity – Measurement Price Calculator plugin for WooCommerce is a tool that allows e-commerce stores to accept custom product quantities and pricing based on measurements. An improper input validation flaw permits attackers to manipulate quantity data without authentication, potentially leading to incorrect pricing, inventory bypasses, or fraudulent transactions.

Technologies: [WP Desk Flexible Quantity – Measurement Price Calculator for WooCommerce](https://junglewise.ai/threats/technologies/flexible-quantity-measurement-price-calculator-for-woocommerce). Vendors: [WP Desk](https://junglewise.ai/threats/vendors/wp-desk).

## Quick answers

**Is CVE-2026-106605 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-106605 being exploited in the wild.

**How severe is CVE-2026-106605?** Medium severity, with a CVSS score of 5.3, published 12 October 2026.

**Which products and versions are affected?** WP Desk Flexible Quantity – Measurement Price Calculator for WooCommerce through 2.3.22.

**Is there a fix for CVE-2026-106605?** Yes: fixed in 2.3.23. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-106605 attacked?** It is attacked over the network, in a web application.

**Am I affected by CVE-2026-106605?** Check whether you run WP Desk Flexible Quantity – Measurement Price Calculator for WooCommerce at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- Fixed in 2.3.23

## Technical details

The plugin fails to properly validate quantity input from users, enabling input data manipulation attacks. An unauthenticated attacker can send crafted requests to modify quantity specifications, bypassing intended business logic. The vulnerability is classified as an improper design issue with low exploitability in practice.

## Affected products

- WP Desk Flexible Quantity – Measurement Price Calculator for WooCommerce through 2.3.22

## Timeline

- 2026-09-30: disclosed
- 2026-10-12: advisory
- 2026-10-12: patched: version 2.3.23 released

## References

- [https://wordpress.org/plugins](https://wordpress.org/plugins)
- [https://patchstack.com/database/wordpress/plugin/flexible-quantity-measurement-price-calculator-for-woocommerce/vulnerability/wordpress-flexible-quantity-measurement-price-calculator-for-woocommerce-plugin-2-3-22-other-vulnerability-type-vulnerability?_s_id=cve](https://patchstack.com/database/wordpress/plugin/flexible-quantity-measurement-price-calculator-for-woocommerce/vulnerability/wordpress-flexible-quantity-measurement-price-calculator-for-woocommerce-plugin-2-3-22-other-vulnerability-type-vulnerability?_s_id=cve)

## Related threats

- [WP Desk Flexible Quantity , Measurement Price Calculator broken access control](https://junglewise.ai/threats/cve-2026-116856-missing-authorization-vulnerability-in-wp-desk-flexible-quantity)
- [WP Desk Flexible Quantity , Measurement Price Calculator broken access control](https://junglewise.ai/threats/cve-2026-62136-wp-desk-flexible-quantity-measurement-price-calculator-broken)