CVE-2026-104641
CVE-2026-104641 · Simple Shopping Cart < 5.3.3 - Unauthenticated Payment Bypass via Unverified PayPal IPN Recipient
This page contains facts from public vulnerability sources. Check the original advisory before updating.
The Simple Shopping Cart WordPress plugin before 5.3.3 does not verify that a PayPal payment notification is for a payment received by the site owner's PayPal account in its default configuration, allowing unauthenticated attackers to have their orders marked as paid using a payment made to an account they control.
CVSS 5.3 · Medium · EPSS 0.1% · Fix available
- Published
- Updated
Affected products and versions
simple shopping cart
- Versions
- ≥ 0, < 5.3.3: Affected (semver)
Update to 5.3.3