Executive brief
StoreGrowth is a WordPress plugin that enables BOGO (buy-one-get-one) and upsell order bump promotions for WooCommerce stores. An unauthenticated attacker can manipulate product prices during checkout, adding any item to the cart at an arbitrary price (e.g., $0.01 instead of the real price), resulting in fraudulent transactions and revenue loss for online merchants.
Technical details
The plugin fails to validate product price parameters in two unauthenticated AJAX actions: "update_offer_product" (BOGO module) and "offer_product_add_to_cart" (Upsell Order Bump module). An attacker with a frontend nonce (publicly available to all visitors) can POST a crafted request specifying an arbitrary "offer_product_cost" or "bogo_price" value; the server accepts it without verification and updates the cart item's price server-side. The manipulated price persists through to the checkout total and payment processing. No authentication or user interaction is required beyond the standard nonce, which is emitted to all visitors. The vulnerability is fixed in version 2.1.2.
Affected products
- StoreGrowth Smart Sales Booster for WooCommerce before 2.1.2
Timeline
- 2026-08-25: disclosed
- 2026: patched: Fixed in version 2.1.2