Unrated severityNVD Advisory· Published Sep 18, 2026
CVE-2026-85350
CVE-2026-85350
Description
The UpsellWP WordPress plugin before 2.2.10 does not check that products added to the cart through a Frequently Bought Together campaign belong to that campaign, allowing unauthenticated users to buy arbitrary products at the campaign's discounted price.
Affected products
1Patches
Vulnerability mechanics
References
1News mentions
0No linked articles in our index yet.