CVE-2026-85350
UNKNOWN
NVD
CVSS Score
0
Severity
UNKNOWN
Published
Sep 18, 2026
Vendor
unknown
Description
The UpsellWP WordPress plugin before 2.2.10 does not check that products added to the cart through a Frequently Bought Together campaign belong to that campaign, allowing unauthenticated users to buy arbitrary products at the campaign's discounted price.