The vulnerability in WPC Name Your Price for WooCommerce WordPress plugin prior to version 2.2.5 arises from the failure to enforce the server-side price allowlist for products set to "Select" price mode. An unauthenticated attacker can exploit this to add products to the cart at arbitrary prices below the merchant-defined allowed prices and complete orders at these reduced prices. This is a separate issue from CVE-2025-12115, which was partially addressed in version 2.2.0 but did not fix the allowlist enforcement for Select-mode products through version 2.2.4.

Exploitation allows unauthenticated users to place orders at prices lower than those defined by the merchant, resulting in potential revenue loss due to underpriced orders. There is no impact on confidentiality or availability reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no patch links or official fixes are provided, users should monitor the vendor's announcements for updates and consider restricting or disabling the affected functionality until a fix is available.