WordPress WP Express Checkout plugin <= 2.3.7 - Price Manipulation vulnerability
Priority LOW 33CWE-1284Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- None
- Attack complexity
- Low
- Impact type
- —
- Confidentiality · integrity · availability
- None · High · None
- Fix status
- No fix listed
Attack profile from CVSS 3.1 · CNA. Fix status from CNA.
Summary
Improper Validation of Specified Quantity in Input vulnerability in Tips and Tricks HQ WP Express Checkout (Accept PayPal Payments) allows Manipulating Hidden Fields.This issue affects WP Express Checkout (Accept PayPal Payments): from n/a through 2.3.7.
Why it matters now
Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00521 44th percentileScored 2026-11-07
Fix No fix listed No fixed version in the sources yet
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- No
- Technical impact
- Partial
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| Tips and Tricks HQ | WP Express Checkout (Accept PayPal Payments) | up to 2.3.7 | — | No fix listed | CNA |
- WP Express Checkout (Accept PayPal Payments) VendorTips and Tricks HQ Affected up to 2.3.7 Fixed in — No fix listed CNA
Remediation
No fixed version listed by the sources yet.
Timeline
- 2026-10-02 Threatist record created from CVE-2024-30527
- 2026-10-03 Alias added: GHSA-qvv7-6wf2-wr97
References
More Tips and Tricks HQ vulnerabilities
- TI-2026-39614 WordPress WP eMember plugin < v10.9.4 - SQL Injection vulnerability CVSS 3.1CRITICAL 9.3
- TI-2020-04618 SQL injection in Tips and Tricks HQ Simple Download Monitor CVSS 3.1HIGH 8.8
- TI-2021-04008 Cross-site request forgery in Tips and Tricks HQ Software License Manager CVSS 3.1HIGH 8.8
- TI-2014-05140 Multiple SQL injection vulnerabilities in the All In One WP Security & Firewall plugin… CVSS 2.0MEDIUM 6.5
- TI-2024-22178 WordPress Easy Accept Payments for PayPal plugin <= 4.9.10 - Broken Access Control vulnerability CVSS 3.1HIGH 7.5
- TI-2015-00834 Cross-site request forgery (CSRF) vulnerability in the All In One WP Security & Firewall… CVSS 2.0MEDIUM 6.8
Sources
- CVE-2024-30527 · CVE Program
- CVE-2024-30527 · NVD
- FIRST EPSS
- GHSA-qvv7-6wf2-wr97 · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences