A critical vulnerability in the StoreGrowth WordPress plugin allows unauthenticated attackers to manipulate product prices during checkout, potentially leading to significant financial loss.

This flaw involves missing authorization (CWE-862) where the plugin fails to validate browser-supplied pricing data. Unauthenticated attackers can inject arbitrary price values into the cart, which are subsequently processed as the final checkout total when the BOGO offer feature is active.

The ability for an unauthenticated actor to set arbitrary prices during the checkout process presents a severe risk of direct financial loss and inventory degradation. Given the CVSS score of 7.5, this high-severity vulnerability allows attackers to bypass payment logic entirely, which can compromise the integrity of the store's revenue stream and business operations.

Immediate Action: Update the StoreGrowth WordPress plugin to version 2.1.2 or later immediately to implement the required input validation.

Proactive Monitoring: Review web access logs for anomalous requests directed at cart or checkout endpoints and monitor transaction logs for orders processed with unusually low or zero-dollar values.

Compensating Controls: Implement a Web Application Firewall (WAF) rule to inspect and block requests containing unexpected price parameters, or temporarily disable the BOGO offer feature until the patch is applied.

Public Exploit Available: Unknown

This vulnerability represents a significant risk to e-commerce integrity and should be prioritized for immediate remediation. Administrators must verify their StoreGrowth plugin version and apply the 2.1.2 update without delay to prevent unauthorized price manipulation and potential financial impact.