Pricing issue being actively exploited

Resolved dev
(@devksec)

4 years, 6 months ago

Hello,

A bug is allowing customers to add products to cart, within the base currency (GBP), then change the currency to USD and the product value just changes currency but not amount.

E.G if a product is added to the cart worth £500, the customer then changes the currency to USD and it is now $500 which is significantly less. We’ve had multiple instance of this over black friday being exploited by customers.

What information from us do you need to further investigate?

Kind Regards

Viewing 10 replies - 1 through 10 (of 10 total)

Thread Starter dev
(@devksec)

4 years, 6 months ago

Looks like to be an issue with https://codecanyon.pluginus.net/item/woocommerce-extra-product-options/7908619?ref=realmag777

When an item is added with extra options, the cart value does not change

Thread Starter dev
(@devksec)

4 years, 6 months ago

Can replicate the issue.

If the above extra product addons is used for to add a product that is a discounted bundle item (https://woocommerce.com/products/product-bundles/) then WOOCs doesn’t change the value of the currency

rolfhuiber
(@rolfhuiber)

4 years, 6 months ago

We have also an issue that the conversion does not work: https://ww.wp.xz.cn/support/topic/is_page-is_singular-called-before-query-is-run/

We have updated our issue but haven’t received a reply since.

Plugin Support mediawebster
(@mediawebster)

4 years, 6 months ago

Hello @devksec

Please read this – https://currency-switcher.com/woocs-labs

Plugin Support mediawebster
(@mediawebster)

4 years, 6 months ago

Hello @rolfhuiber

I answered you in your topic – https://ww.wp.xz.cn/support/topic/is_page-is_singular-called-before-query-is-run/

Thread Starter dev
(@devksec)

4 years, 6 months ago

@mediawebster we have the pro version, should we use the support forum instead.

Both extra product options + product bundles have their own patches but do not seem to be working

Thread Starter dev
(@devksec)

4 years, 6 months ago

@mediawebster can we get an updated version of this please (Screenshots+ code)

https://currency-switcher.com/product-bundles-by-somewherewarm/

Thread Starter dev
(@devksec)

4 years, 6 months ago

@mediawebster https://currency-switcher.com/woocommerce-extra-product-options-themecomplete

the above patch is missing the php file to add the code to. E.G

In file wp-content\plugins\woocommerce-tm-extra-product-options\include\classes add next code:

Thread Starter dev
(@devksec)

4 years, 6 months ago

Further testing shows that this issue is the current adaptation for https://currency-switcher.com/woocommerce-extra-product-options-themecomplete/ needs updating to resolve the issue.

The cart value, when a product has a discounted bundled addon product which is a product bundle, calculates the discount incorrectly.

It seems to be a specific issue with the combination of these two plugins and within the cart as the calculation on the product page is ok.

Plugin Support mediawebster
(@mediawebster)

4 years, 6 months ago

Hello @devksec

Thank you for your research
Please read this – https://currency-switcher.com/woocs-labs

Viewing 10 replies - 1 through 10 (of 10 total)

The topic ‘Pricing issue being actively exploited’ is closed to new replies.