CVE-2026-110364 WP Desk CVE debrief

Who should care

Defenders responsible for WordPress installations with the Flexible Quantity – Measurement Price Calculator for WooCommerce plugin should assess exposure and verify the plugin version.

Why it matters

Defenders should care about CVE-2026-110364 because it affects the WordPress Flexible Quantity – Measurement Price Calculator for WooCommerce plugin, potentially allowing attackers to exploit incorrectly configured access control security levels. The impact of this vulnerability requires verification from official sources, and defenders should prioritize verifying the plugin version and reviewing access control configurations.

• Verify plugin version and update if necessary to prevent potential exploitation
• Review and correct access control configurations to prevent unauthorized access

Technical summary

The Flexible Quantity – Measurement Price Calculator for WooCommerce plugin, versions up to 2.3.23, is vulnerable to a Missing Authorization issue. This could allow attackers to exploit incorrectly configured access control security levels. The vulnerability has a CVSS score of 5.3 and is classified as MEDIUM severity. Defenders should prioritize verifying the version of the Flexible Quantity – Measurement Price Calculator for WooCommerce plugin and ensuring it is updated to a version beyond 2.3.23 if possible. This involves reviewing access control configurations to prevent unauthorized access and ensuring the plugin is properly configured.

Defensive priority

Defenders should prioritize verifying the version of the Flexible Quantity – Measurement Price Calculator for WooCommerce plugin and ensuring it is updated to a version beyond 2.3.23 if possible.

Recommended defensive actions

• Verify the version of the Flexible Quantity – Measurement Price Calculator for WooCommerce plugin and update it if necessary
• Review access control configurations for the plugin
• Monitor for potential exploitation attempts
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up
• Review the supplied official advisory or CVE record to validate affected scope, severity, and vendor guidance
• Plan vendor-supported updates or mitigations through normal change control where exposure is confirmed
• Check relevant monitoring, detection, and logs for exposed assets that need extra review

Evidence notes

The CVE record and source item provide details about the vulnerability, including its CVSS score of 5.3 and MEDIUM severity. However, there is limited information available about potential exploits or impacts.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.