That is just bad design. No server side cart validation? Archive: https://archive.today/rt2pd From the post: >>In a post titled [Hack] 4 Pieces Original Chicken (or Hot & Spicy Where Available) $7.45 @ KFC (Desktop Browser Required), Andrew — or AwesomeAndrew as he’s known there — wrote on the Australian deals website that KFC’s “very bad cybersecurity” presented an opportunity.