What’s Vulnerable › Vulnerabilities

CVE-2025-8198: MinimogWP – The High Converting eCommerce WordPress Theme <= 3.9.0 - Unauthenticated Price Manipulation

• Severity: high (CVSS 7.5 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.4% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2025-07-26 · updated 2026-06-17
• Weakness: CWE-472

Description

The MinimogWP – The High Converting eCommerce WordPress Theme theme for WordPress is vulnerable to price manipulation in all versions up to, and including, 3.9.0. This is due to an insufficient check on quantity values when changing quantities in the cart. This makes it possible for unauthenticated attackers to add items to the cart and adjust the quantity to a fractional amount, causing the price to change based on the fractional amount. The vulnerability cannot be exploited if WooCommerce version 9.8.2+ is installed.

Affected products

• ThemeMove MinimogWP – The High Converting eCommerce WordPress Theme: through 3.9.0

References

• https://changelog.thememove.com/minimog-wp/
• https://www.wordfence.com/threat-intel/vulnerabilities/id/cfea0427-78dc-4151-864a-63b6761fc294?source=cve

Get alerted when CVE-2025-8198 or the next vulnerability affects your stack