{"id":"CVE-2024-30527","state":"PUBLISHED","title":"WordPress WP Express Checkout plugin <= 2.3.7 - Price Manipulation vulnerability","description":"Improper Validation of Specified Quantity in Input vulnerability in Tips and Tricks HQ WP Express Checkout (Accept PayPal Payments) allows Manipulating Hidden Fields.This issue affects WP Express Checkout (Accept PayPal Payments): from n/a through 2.3.7.","publishedAt":"2024-05-17T08:20:59.609Z","updatedAt":"2026-04-28T16:09:26.267Z","severity":{"score":7.5,"label":"High","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","source":"Patchstack"},"assigner":"Patchstack","products":["Tips and Tricks HQ WP Express Checkout (Accept PayPal Payments)"],"affected":[{"vendor":"Tips and Tricks HQ","product":"WP Express Checkout (Accept PayPal Payments)","packageName":"wp-express-checkout","defaultStatus":"unaffected","versions":[{"version":"n/a","status":"affected","lessThanOrEqual":"2.3.7","changes":[{"at":"2.3.8","status":"unaffected"}],"versionType":"custom"}],"collectionURL":"https://wordpress.org/plugins"}],"references":["https://patchstack.com/database/vulnerability/wp-express-checkout/wordpress-wp-express-checkout-plugin-2-3-7-price-manipulation-vulnerability?_s_id=cve"],"weaknesses":["CWE-1284"],"ingestedAt":"2026-10-29T20:07:21.467Z","source":{"repository":"CVEProject/cvelistV5","path":"cves/2024/30xxx/CVE-2024-30527.json","commit":"556c9d3a8cd17e218bb8e452ba7cd619a384ff47"},"raw":{"dataType":"CVE_RECORD","dataVersion":"5.2","cveMetadata":{"cveId":"CVE-2024-30527","state":"PUBLISHED","datePublished":"2024-05-17T08:20:59.609Z","dateUpdated":"2026-04-28T16:09:26.267Z","assignerShortName":"Patchstack","assignerOrgId":"21595511-bba5-4825-b968-b78d1f9984a3","dateReserved":"2024-03-27T12:56:45.184Z"},"containers":{"cna":{"title":"WordPress WP Express Checkout plugin <= 2.3.7 - Price Manipulation vulnerability","descriptions":[{"lang":"en","value":"Improper Validation of Specified Quantity in Input vulnerability in Tips and Tricks HQ WP Express Checkout (Accept PayPal Payments) allows Manipulating Hidden Fields.This issue affects WP Express Checkout (Accept PayPal Payments): from n/a through 2.3.7."}],"affected":[{"vendor":"Tips and Tricks HQ","product":"WP Express Checkout (Accept PayPal Payments)","packageName":"wp-express-checkout","defaultStatus":"unaffected","versions":[{"version":"n/a","status":"affected","lessThanOrEqual":"2.3.7","changes":[{"at":"2.3.8","status":"unaffected"}],"versionType":"custom"}],"collectionURL":"https://wordpress.org/plugins"}],"references":[{"url":"https://patchstack.com/database/vulnerability/wp-express-checkout/wordpress-wp-express-checkout-plugin-2-3-7-price-manipulation-vulnerability?_s_id=cve","tags":["vdb-entry"]}],"metrics":[{"cvssV3_1":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":7.5,"baseSeverity":"HIGH","confidentialityImpact":"NONE","integrityImpact":"HIGH","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","version":"3.1"},"format":"CVSS","scenarios":[{"lang":"en","value":"GENERAL"}]}],"problemTypes":[{"descriptions":[{"cweId":"CWE-1284","description":"CWE-1284 Improper Validation of Specified Quantity in Input","lang":"en","type":"CWE"}]}],"providerMetadata":{"shortName":"Patchstack","orgId":"21595511-bba5-4825-b968-b78d1f9984a3","dateUpdated":"2026-04-28T16:09:26.267Z"},"credits":[{"lang":"en","type":"finder","user":"00000000-0000-4000-9000-000000000000","value":"Xinzhi Luo (Patchstack Alliance)"}],"impacts":[{"capecId":"CAPEC-162","descriptions":[{"lang":"en","value":"CAPEC-162 Manipulating Hidden Fields"}]}],"solutions":[{"lang":"en","supportingMedia":[{"base64":false,"type":"text/html","value":"Update to 2.3.8 or a higher version."}],"value":"Update to 2.3.8 or a higher version."}],"source":{"discovery":"EXTERNAL"},"x_generator":{"engine":"Vulnogram 0.1.0-dev"}},"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"id":"CVE-2024-30527","role":"CISA Coordinator","options":[{"Exploitation":"none"},{"Automatable":"no"},{"Technical Impact":"partial"}],"version":"2.0.3","timestamp":"2024-05-17T11:59:04.820325Z"}}}],"providerMetadata":{"shortName":"CISA-ADP","orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","dateUpdated":"2024-06-04T17:39:30.798Z"}},{"title":"CVE Program Container","references":[{"url":"https://patchstack.com/database/vulnerability/wp-express-checkout/wordpress-wp-express-checkout-plugin-2-3-7-price-manipulation-vulnerability?_s_id=cve","tags":["vdb-entry","x_transferred"]}],"providerMetadata":{"shortName":"CVE","orgId":"af854a3a-2127-422b-91ae-364da2661108","dateUpdated":"2024-08-02T01:38:59.983Z"}}]}}}