Read the docs
TI-2025-07501 Aliases CVE-2025-8198GHSA-m6rg-vwrp-3cg5

MinimogWP – The High Converting eCommerce WordPress Theme <= 3.9.0 - Unauthenticated Price Manipulation

Priority LOW 39CWE-472Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Impact type
—
Confidentiality · integrity · availability
None · High · None
Fix status
No fix listed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA.

Summary

The MinimogWP – The High Converting eCommerce WordPress Theme theme for WordPress is vulnerable to price manipulation in all versions up to, and including, 3.9.0. This is due to an insufficient check on quantity values when changing quantities in the cart. This makes it possible for unauthenticated attackers to add items to the cart and adjust the quantity to a fractional amount, causing the price to change based on the fractional amount. The vulnerability cannot be exploited if WooCommerce version 9.8.2+ is installed.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00385 32nd percentileScored 2026-11-07
Fix No fix listed No fixed version in the sources yet

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
Yes
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
ThemeMoveMinimogWP – The High Converting eCommerce WordPress Themeup to 3.9.0—No fix listedCNA
  • MinimogWP – The High Converting eCommerce WordPress Theme VendorThemeMove Affected up to 3.9.0 Fixed in — No fix listed CNA

Remediation

No fixed version listed by the sources yet.

Timeline

  1. 2026-10-02 Threatist record created from CVE-2025-8198
  2. 2026-10-03 Alias added: GHSA-m6rg-vwrp-3cg5

References

Other 2

  • TI-2024-12816 MinimogWP – The High Converting eCommerce WordPress Theme <= 3.7.0 - Unauthenticated Local PHP File Inclusion CVSS 3.1CRITICAL 9.8
  • TI-2025-36015 WordPress Makeaholic Theme <= 1.8.5 - Broken Access Control Vulnerability CVSS 3.1CRITICAL 9.8
  • TI-2025-26216 WordPress Amely theme <= 3.1.4 - SQL Injection vulnerability CVSS 3.1CRITICAL 9.8
  • TI-2025-37087 WordPress Learts Addons Plugin < 1.7.5 - SQL Injection Vulnerability CVSS 3.1CRITICAL 9.3
  • TI-2025-34464 WordPress Unicamp Theme <= 2.6.3 - Local File Inclusion Vulnerability CVSS 3.1CRITICAL 9.8
  • TI-2025-34463 WordPress Makeaholic Theme <= 1.8.4 - Local File Inclusion Vulnerability CVSS 3.1CRITICAL 9.8
See all 31 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences