CVE-2026-16620 patches a bypass in the Name Your Price WooCommerce plugin (versions 2.2.0 through 2.2.4) where an unauthenticated attacker can set custom prices on products using the Select price mode. This is not cart manipulation that gets caught at checkout — this is a completed transaction at a price of the attacker's choosing, processed by WooCommerce as a legitimate order and potentially fulfilled by the merchant.
The vulnerability exists because the original CVE-2025-12115 patch (version 2.2.0) addressed custom-price abuse only in the primary price-enforcement path. The Select-mode allowlist — the code that is supposed to restrict which prices a buyer can select — was never protected at any point. The vendor treated the reported vulnerability as a single-point repair rather than a signal to audit the entire price-enforcement subsystem. This is a documented pattern: emergency patches are scoped to the reported proof-of-concept, and adjacent code paths in the same feature context inherit the assumption of 'not in scope.'
If you run this plugin, upgrade to version 2.2.5 or later immediately. The four-version gap (2.2.0–2.2.4) created a window where merchants who applied the CVE-2025-12115 patch believed they were protected but were not. Review your order logs for any unusually low-priced Select-mode purchases during that period — the attack surface here is commercial fraud rather than technical exploitation. An attacker doesn't need sophistication; they need to place an order at a price you didn't intend to offer and wait for fulfillment.
The Select-mode allowlist should now be audited across all price modes for consistency, not just patched as a single path. This vulnerability class — unauthenticated price manipulation in e-commerce — has recurred across the WooCommerce plugin ecosystem, and the partial-patch pattern means applying a CVE-linked update does not guarantee the subsystem is fully secured.