CVE-2026-2996

The CVSS 7.5 rating on this vulnerability is a category error. An attacker manipulating addon prices to pay $10 for a $500 product isn't exploiting a technical flaw — they're committing wire fraud. The real risk is business consequence (repeatable, automated exploitation at scale) that CVSS doesn't model. Treat the CVSS score as a technical exploitability indicator, not a severity indicator for this vulnerability class. The 'partial patch' in version 1.6.19, with exploitation still possible in later versions, reveals a fundamental architectural failure: addon validation was implemented as a presentation-layer concern rather than a transactional integrity control. The validation happens in 'validate_cart_data' — a function that runs on data the client has already submitted. The critical moment where prices should be locked in has already passed. An attacker doesn't need to hack the code; they just need to understand what the validation expects and omit it. For defenders, the practical investigation is straightforward but critical: examine whether version 1.6.21 shows a structural refactor or another incremental bypass patch. The git history is the forensic evidence. If you see 'validate_cart_data' modified across versions 1.6.18, 1.6.19, 1.6.20, and 1.6.21, that's not a fix timeline — that's active exploitation feeding a development bottleneck. Each patch creates new bypass surface as attackers map new validation expectations. The commit-diff tells you whether validation logic moved to order-commit time or just got relocated to a different function that third-party code can intercept first. The deeper risk is code archaeology. When 1.6.19 'partially patched' the flaw, the original bypass logic almost certainly still exists in the codebase — commented out, wrapped in conditionals, or left as a callable function with a misleading name. Deprecated doesn't mean deleted in plugin ecosystems. It means forgotten but still executable. A WooCommerce core update or conflicting plugin can resurrect dormant bypass paths that were supposedly patched. The real vulnerability may be a time bomb buried in your codebase, not the current version number. Finally, recognize that publishing the CVE has changed the threat landscape. The bypass technique is now in NVD, security feeds, and attack tooling. Partial patches don't just leave dormant code — they create a documented exploitation pathway that outlasts the vulnerability. Even if 1.6.21 is a genuine fix, every unpatched 1.6.x installation now has a permanent exploitation surface, not because the code is broken, but because the code is fully documented. Monitor for similar patterns across your other WooCommerce extensions; the validation architecture that produced this flaw is likely replicated in adjacent plugins.

Reviewed through automated stages and approved by a human before publication.