CVE-2026-62136
MediumCVSS 5.3Exploitation Probability (EPSS)
Low risk7th percentile - higher than 7% of all known CVEs
Summary
The Flexible Quantity – Measurement Price Calculator for WooCommerce plugin in versions up to and including 2.3.21 contains a Broken Access Control vulnerability exploitable by an unauthenticated attacker. This allows operations beyond granted permissions.
Risk Assessment
An unauthenticated attacker can bypass access control mechanisms, potentially leading to data modification or unauthorized actions in the WooCommerce store.
Recommendation
Update the Flexible Quantity – Measurement Price Calculator for WooCommerce plugin to a version newer than 2.3.21 as soon as a fix becomes available.
Other vulnerabilities in Flexible Quantity – Measurement Price Calculator for WooCommerce
See all- CVE-2026-110364Medium
The WooCommerce plugin 'Flexible Quantity – Measurement Price Calculator' (versions up to 2.3.23) has a missing authorization vulnerability, allowing exploitation of incorrectly configured access control security levels.
- CVE-2026-106605Medium
The Flexible Quantity – Measurement Price Calculator for WooCommerce plugin (up to version 2.3.22) contains an Improper Validation of Specified Quantity in Input vulnerability that allows input data manipulation. An attacker may supply invalid quantity values, potentially leading to incorrect price or product quantity calculations.
Original NVD description (English source)
Unauthenticated Broken Access Control in Flexible Quantity – Measurement Price Calculator for WooCommerce <= 2.3.21 versions.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS