CVE-2026-104642
CVE-2026-104642 · Simple Shopping Cart 5.1.3 - 5.3.2 - Contributor+ Price Manipulation via Price Verification Bypass
Esta página presenta datos de fuentes públicas de vulnerabilidades. Consulta el aviso original antes de actualizar.
The Simple Shopping Cart WordPress plugin before 5.3.3 does not verify submitted product prices against a value only the site owner can set, allowing users with the Contributor role and above to register attacker-chosen prices for existing products, which any visitor can then use to add those products to the cart at that price.
CVSS 2.7 · Baja · EPSS 0,1% · Corrección disponible
- Publicación
- Actualización
Productos y versiones afectados
simple shopping cart
- Versiones
- ≥ 5.1.3, < 5.3.3: Afectada (semver)
Actualiza a 5.3.3