# CVE-2026-49110: WP Swings Upsell Order Bump Offer for WooCommerce broken authentication

Source: https://junglewise.ai/threats/cve-2026-49110-wp-swings-upsell-order-bump-offer-for-woocommerce-broken  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-06-15. Updated: 2026-06-15  
License: CC BY 4.0 with a link back

CVE-2026-49110 · Severity: high · CVSS 7.5 · Published 2026-06-15

A vulnerability exists in a popular WooCommerce extension used to offer additional products to customers during the checkout process. An unauthorized attacker can exploit this flaw to manipulate order details, potentially allowing them to change product prices or bypass standard purchasing rules. This could lead to financial loss for the merchant and unauthorized acquisition of goods.

Technologies: [WP Swings Upsell Order Bump Offer for WooCommerce](https://junglewise.ai/threats/technologies/upsell-order-bump-offer-for-woocommerce). Vendors: [WP Swings](https://junglewise.ai/threats/vendors/wp-swings).

## Quick answers

**Is CVE-2026-49110 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-49110 being exploited in the wild.

**How severe is CVE-2026-49110?** High severity, with a CVSS score of 7.5, published 15 June 2026.

**Which products and versions are affected?** WP Swings Upsell Order Bump Offer for WooCommerce <= 3.1.4.

**Is there a fix for CVE-2026-49110?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2026-49110 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2026-49110?** Check whether you run WP Swings Upsell Order Bump Offer for WooCommerce at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

The Upsell Order Bump Offer for WooCommerce plugin (versions 3.1.4 and below) suffers from a broken authentication vulnerability, specifically categorized as improper validation of specified quantity in input (CWE-1284). The flaw allows an unauthenticated remote attacker to perform actions that should be restricted to privileged users or validated system processes. Specifically, the vulnerability enables price manipulation during the checkout process. This occurs because the plugin fails to properly verify the integrity of order data submitted by the user. A fix is available in version 3.1.5.

## Affected products

- WP Swings Upsell Order Bump Offer for WooCommerce <= 3.1.4

## Timeline

- 2026-05-09: other: Reported by Jakub Herman
- 2026-06-04: advisory: Patchstack advisory published
- 2026-06-15: disclosed: NVD publication date

## References

- [https://patchstack.com/database/wordpress/plugin/upsell-order-bump-offer-for-woocommerce/vulnerability/wordpress-upsell-order-bump-offer-for-woocommerce-plugin-3-1-4-price-manipulation-vulnerability?_s_id=cve](https://patchstack.com/database/wordpress/plugin/upsell-order-bump-offer-for-woocommerce/vulnerability/wordpress-upsell-order-bump-offer-for-woocommerce-plugin-3-1-4-price-manipulation-vulnerability?_s_id=cve)

## Related threats

- [WP Swings Upsell Order Bump Offer for WooCommerce broken access control](https://junglewise.ai/threats/cve-2026-115431-missing-authorization-vulnerability-in-wp-swings-upsell-order)
- [WP Swings Upsell Order Bump Offer for WooCommerce reflected XSS](https://junglewise.ai/threats/cve-2026-116409-improper-neutralization-of-input-during-web-page-generation)