CVE-2025-12115 affects the WPC Name Your Price for WooCommerce plugin, where the plugin does not properly disable the custom price naming feature on the server side when it is disabled for a product. This allows unauthenticated attackers to bypass intended pricing restrictions and purchase products at unauthorized lower prices. The vulnerability stems from relying on client-side enforcement rather than robust server-side validation, classified under CWE-602. The issue impacts all versions up to and including 2.1.9. There is no vendor advisory or patch information provided, and no known exploits in the wild have been reported.

Attackers can exploit this vulnerability to purchase products at prices lower than intended by bypassing disabled custom pricing controls. This can lead to financial loss for merchants using the affected plugin. The vulnerability does not impact confidentiality or availability but has a high impact on integrity due to unauthorized price manipulation.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should consider disabling or removing the affected plugin or implementing custom server-side validation to enforce pricing restrictions. Monitor vendor channels for updates and apply patches promptly once released.