Unauthenticated Price Manipulation in StoreGrowth WordPress Plugin

The StoreGrowth WordPress plugin before 2.1.2 does not validate a browser-supplied product price on two of its unauthenticated actions, allowing unauthenticated attackers to add a product to the cart at an arbitrary, attacker-chosen price that carries through to the checkout total when the BOGO offer feature is enabled.

Casky was already ahead

This CVE exploits attack patterns that Casky's 283matched skills already investigate — long before this vulnerability was disclosed. Claude's reasoning model maps these techniques to MITRE ATT&CK, so practitioners who ran these skills have already seen the threat behaviour in their findings.

Analysis

CVE-2026-78137 exploits a critical input validation flaw in the StoreGrowth WordPress plugin, where two unauthenticated actions fail to validate product prices supplied by the client. This allows attackers to arbitrarily reduce purchase prices during checkout, particularly when the BOGO (Buy One Get One) feature is enabled, resulting in revenue loss and potential cart manipulation attacks. The vulnerability affects any WordPress installation running StoreGrowth before version 2.1.2, impacting e-commerce sites of all sizes that rely on this plugin for sales functionality.

Casky's 283 matching skills detect the attack patterns mapped to TA0004 (Privilege Escalation) and TA0006 (Credential Access) by analyzing suspicious transaction modifications and unauthenticated API calls. Practitioners using Casky would observe findings highlighting: (1) price parameter tampering in cart-add requests lacking proper authentication checks, (2) checkout totals diverging from server-side product catalogs, (3) abnormal payment amounts inconsistent with inventory records, and (4) CWE-862 (Missing Authorization) patterns where sensitive pricing logic executes without user verification. Extended reasoning across these 283 skills correlates client-side price modifications with incomplete server-side validation, enabling security teams to identify compromised checkouts before revenue impact occurs.

Live Threat IntelligenceComing soon

Casky Risk Score

—

EPSS Probability

—

Shodan Exposure

—

GreyNoise Signal

—

Composite risk scoring from EPSS, CISA KEV, Shodan, and GreyNoise — 21 security APIs correlated into a single Casky Risk Score. Coming in Casky Pro. Join early access →

283 Casky skills cover this attack pattern

These skills use Claude AI's reasoning model to surface findings in the same attack categories as CVE-2026-78137.

abusing-dpapi-for-credential-access

red teaming · high

Run

abusing-shadow-credentials-for-privesc

red teaming · high

Run

Access with Stolen Session Cookie

identity access management · low

Run

MITRE ATT&CK Techniques

TA0004 TA0006

Investigate the attack patterns behind CVE-2026-78137

Casky has 283 skills that investigate the attack patterns behind CVE-2026-78137. Run one and get CVSS-scored findings in 3 minutes.

Run the skill that detects this →

X Instagram LinkedIn