CVE-2026-104641
CVE-2026-104641 · Simple Shopping Cart < 5.3.3 - Unauthenticated Payment Bypass via Unverified PayPal IPN Recipient
Esta página presenta datos de fuentes públicas de vulnerabilidades. Consulta el aviso original antes de actualizar.
The Simple Shopping Cart WordPress plugin before 5.3.3 does not verify that a PayPal payment notification is for a payment received by the site owner's PayPal account in its default configuration, allowing unauthenticated attackers to have their orders marked as paid using a payment made to an account they control.
CVSS 5.3 · Media · EPSS 0,1% · Corrección disponible
- Publicación
- Actualización
Productos y versiones afectados
simple shopping cart
- Versiones
- ≥ 0, < 5.3.3: Afectada (semver)
Actualiza a 5.3.3