A FusionPoint IT security research case study · September 2026

The short version

During proactive security research, FusionPoint identified a price-manipulation vulnerability in MageWorx Advanced Product Options, a third-party app used by thousands of Shopify stores to sell custom options — lens upgrades, engraving, add-ons, color choices, and similar product variations.

In one common configuration, the app lets the shopper’s own browser tell the store how much an option costs — and the store’s checkout trusts that number. An attacker with no more than a browser’s developer tools can change any option price to $0.00 (or less). In a public demonstration of the technique, a product listed at $11,745.99 was taken to $0.00 in the cart — no account, no discount code, no payment details required.

The good news: this is fixable, and not every store running the app is exposed. The problem lives in a specific configuration of the app — and in the safe configurations, tampered prices are ignored entirely. Here’s what the issue is, how we found it, and what any store owner can do about it.

The issue: the checkout trusts a price the shopper controls

MageWorx Advanced Product Options (APO) is what lets a store charge extra for a premium lens, a monogram, or an upgraded part. It handles money — which is exactly why it stood out to us. When we traced how those option prices flow from the product page to the checkout, we found a broken trust boundary:

The store shows the option (“Blue light lenses: +$20”) on the product page.
The math happens in the shopper’s browser, and the resulting dollar amount is attached to the cart request as a hidden field.
The store’s backend adds that browser-supplied amount to the line total — without checking it against anything on the server.

Step 3 trusts step 2. Anyone who can edit a web request — again, just the developer tools built into every browser — can change that hidden field from “+$20” to “$0.00” or “-$20”. The store happily discounts it.

This is a client-side pricing flaw: the price is computed where the attacker controls it, and the server never re-verifies it.

Why it matters

Anyone can do it. No account needed, no special tools — guest shoppers can tamper with their own carts before checkout.
It’s silent. The order looks completely normal. No error, no flag, no suspicious discount code — the store just receives an order at the manipulated price and fulfills it at a loss.
It scales. Automated scripts can run the tamper across a storefront continuously, draining inventory at $0 before anyone notices.
It’s an app problem, not a “we got hacked” problem. No malware, no breach, no stolen data. The store’s own checkout is doing what it was told — which makes it much harder to detect with typical security tools.

For a business selling physical goods, every exploited order is lost product, lost shipping, and lost margin. And for stores running the affected configuration, the exposure lasts as long as the configuration does.

How we found it

FusionPoint runs an ongoing security research program that examines the third-party tools small businesses depend on. APO stood out for two reasons: it’s installed on a very large number of storefronts, and it computes money — option surcharges are real revenue.

Tracing the price flow from product page to checkout is what exposed the flaw. Option prices are calculated in the browser, shipped to the store as a hidden cart field, and applied by the store’s backend with no server-side check. We confirmed the practical impact: change the hidden field, and the store accepts the new price — including $0.00.

We then looked at how widespread the exposure actually was. Surveying storefronts running the app, we found the high-risk configuration present in roughly a dozen of them — this is a live issue in the wild, not a hypothetical one.

The most useful finding, though, was what wasn’t vulnerable. Running the app is not the same as being exposed. In storefront configurations where option prices live server-side — set as real products or variants with fixed prices in the admin — the storefront ignored tampered price data entirely and cart totals stayed correct. The vulnerability is a mode of the app, not an inevitable property of it. That’s the good news for store owners: it means there’s a clear fix.

What can be done about it

If you use MageWorx APO (or any app that adds priced options to products):

Check your configuration mode. The risky setup is one where the browser calculates the surcharge and the store trusts it. The safe setups are those where option prices are resolved server-side — for example, where paid options are created as separate products, or linked to real variants with fixed, admin-set prices.
Contact the app vendor. Confirm you’re on the latest version and ask which configuration they recommend. If a safe mode is available, switch to it — it removes the vulnerability entirely rather than mitigating it.
If you must keep a client-side pricing configuration short-term, monitor for the symptoms: line-item totals that don’t match your catalog, repeated $0.00 lines, or clusters of identical “custom option” orders. Build an order-review rule that flags any line total that doesn’t match the configured price.

Quick check you can do right now

On a product with a paid option, open your browser’s developer tools and look at the network request fired when you click “Add to Cart.” If you can see the option price or total sitting in the request as plain text — and especially if you can change it and the cart total changes — your prices are being trusted from the browser. That’s the pattern to fix.

Longer-term hygiene (good for any store)

Prefer architectures where prices are server-authoritative. Your checkout should never accept a price from the browser as truth — it should look prices up itself.
Audit your third-party apps the way you audit passwords: what handles money, what touches customer data, and what does it trust?
Re-test your storefront the way an attacker would — on a schedule, not just once after a launch.

Want us to check your storefront?

If you run a store with product options, custom pricing, or any app that “calculates” prices for your customers, we’ll review your cart and checkout configuration and tell you honestly what we find — even if the answer is “you’re fine.”

Contact FusionPoint IT:

We answer questions directly, no ticket queue required.

The $0 Shopping Cart: How a Popular Shopify App Let Shoppers Write Their Own Prices