CVE-2026-94254

MediumCVSS 5.3/10Last modified Oct 15, 2026

Description

The SellKit WordPress plugin before 2.8.0 does not validate a client-supplied product price when totals are recalculated during checkout, allowing unauthenticated attackers to place orders for any purchasable product at a price of their own choosing.

Metrics

CVSS 3.1 5.3/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N

Weakness enumeration

CWE-862

Affected software

No affected versions have been published.

Timeline

Published
Oct 14, 2026
Last modified
Oct 15, 2026
NVD status
Deferred

Related CVEs from 2026

CVE-2026-942568.1The SMS Alert WordPress plugin before 4.0.1 does not verify that the account being logged in is the one the verified one-time code belongs CVE-2026-942578.1The SMS Alert WordPress plugin before 4.0.1 does not bind the account whose password is being changed to the phone number that was actuallyCVE-2026-942582.7The SMS Alert WordPress plugin before 4.0.1 does not check that the acting administrator is allowed to manage the selected users before retCVE-2026-94268.8A vulnerability was detected in Edimax EW-7438RPn 1.31. This affects the function formHwSet of the file /goform/formHwSet. The manipulation CVE-2026-942605.3The Sifalo Pay WordPress plugin before 2.5.3 does not verify ownership of, or authorisation for, the order being updated when it handles a CVE-2026-942615.3The Sifalo Pay WordPress plugin before 2.5.3 does not verify that a payment transaction identifier belongs to the order it is confirming, nCVE-2026-942628.1The Advanced Custom Fields: Extended WordPress plugin before 0.9.2.8, Advanced Custom Fields: Extended PRO WordPress plugin before 0.9.2.8 dCVE-2026-942634.8The Advanced Custom Fields: Extended and Advanced Custom Fields: Extended PRO WordPress plugins from 0.9.2.4 to 0.9.2.7 do not consistently CVE-2026-942646.8The Advanced Custom Fields: Extended WordPress plugin before 0.9.2.8, Advanced Custom Fields: Extended PRO WordPress plugin before 0.9.2.8 dCVE-2026-94265When processing an HTTP redirect to a URL containing userinfo (a `username:password` component), curl might erroneously retain and re-transmCVE-2026-94266libcurl could accidentally return a URL for `curl_easy_getinfo()`'s `CURLINFO_EFFECTIVE_URL` option containing credentials, even though neitCVE-2026-942679.0The Advanced Custom Fields: Extended WordPress plugin before 0.9.2.8, Advanced Custom Fields: Extended PRO WordPress plugin before 0.9.2.8 d
CVE-2026-94254: Medium severity, CVSS 5.3 | Vulnix