CVE-2026-85350 UpsellWP < 2.2.10 - Unauthenticated Price Manipulation via Frequently Bought Together
Unauthenticated attackers can manipulate cart prices by adding arbitrary products to Frequently Bought Together campaigns, bypassing intended pricing logic.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2026-85350?
CVE-2026-85350 is a medium-severity vulnerability in Unknown UpsellWP, published on 18 Sep 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
The UpsellWP WordPress plugin before 2.2.10 does not check that products added to the cart through a Frequently Bought Together campaign belong to that campaign, allowing unauthenticated users to buy arbitrary products at the campaign's discounted price.
Weakness: CWE-287
Which versions are affected by CVE-2026-85350?
How do I fix CVE-2026-85350?
No fix has been published for CVE-2026-85350 yet. Limit exposure of the affected software until one is available.
Is CVE-2026-85350 being exploited?
There is no known exploitation of CVE-2026-85350 in the wild and no public exploit code.
Sources
Also known as GHSA-3x7x-rg4h-cpjq.