CVE-2026-104642
CVE-2026-104642 · Simple Shopping Cart 5.1.3 - 5.3.2 - Contributor+ Price Manipulation via Price Verification Bypass
This page contains facts from public vulnerability sources. Check the original advisory before updating.
The Simple Shopping Cart WordPress plugin before 5.3.3 does not verify submitted product prices against a value only the site owner can set, allowing users with the Contributor role and above to register attacker-chosen prices for existing products, which any visitor can then use to add those products to the cart at that price.
CVSS 2.7 · Low · EPSS 0.1% · Fix available
- Published
- Updated
Affected products and versions
simple shopping cart
- Versions
- ≥ 5.1.3, < 5.3.3: Affected (semver)
Update to 5.3.3