CVE-2026-85350 — UpsellWP < 2.2.10 - Unauthenticated Price Manipulation via Frequently Bought Together
The UpsellWP WordPress plugin before 2.2.10 does not check that products added to the cart through a Frequently Bought Together campaign belong to that campaign, allowing unaut…
Published: 2026-09-18 · CVSS: 5.3 · CVSS 3.1
The UpsellWP WordPress plugin before 2.2.10 does not check that products added to the cart through a Frequently Bought Together campaign belong to that campaign, allowing unauthenticated users to buy arbitrary products at the campaign's discounted price.
Source: CVE Program · Revision 8b16575c39f1e1810c5e863010da073d2d3285e7