CVE-2025-3874

MEDIUM 6.5

WordPress Simple PayPal Shopping Cart <= 5.1.3 - Insecure Direct Object Reference

CVSS Score

6.5

EPSS Score

0.0%

EPSS Percentile

0th

The WordPress Simple Shopping Cart plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 5.1.3 due to lack of randomization of a user controlled key. This makes it possible for unauthenticated attackers to access customer shopping carts and edit product links, add or delete products, and discover coupon codes.

CWE	CWE-639
Vendor	mra13
Product	simple shopping cart
Published	May 1, 2025
Last Updated	Apr 8, 2026

Stay Ahead of the Next One

Get instant alerts for mra13 simple shopping cart

Be the first to know when new medium vulnerabilities affecting mra13 simple shopping cart are published — delivered to Slack, Telegram or Discord.

Get Free Alerts → Free · No credit card · 60 sec setup

CVSS v3 Breakdown

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N

Attack Vector

Attack Complexity

Privileges Required

User Interaction

Scope

Confidentiality

Integrity

Availability

Affected Versions

mra13 / Simple Shopping Cart

0 ≤ 5.1.3

References

NVD ↗ CVE.org ↗ EPSS Data ↗

wordfence.com: https://www.wordfence.com/threat-intel/vulnerabilities/id/4fed59bf-885b-4a06-aff2-8e5ab5f83ba7?source=cve plugins.trac.wordpress.org: https://plugins.trac.wordpress.org/browser/wordpress-simple-paypal-shopping-cart/tags/5.1.2/includes/class-wpsc-cart.php#L68 plugins.trac.wordpress.org: https://plugins.trac.wordpress.org/browser/wordpress-simple-paypal-shopping-cart/tags/5.1.2/includes/class-wpsc-cart.php#L32 plugins.trac.wordpress.org: https://plugins.trac.wordpress.org/browser/wordpress-simple-paypal-shopping-cart/tags/5.1.2/wp_shopping_cart.php#L525 plugins.trac.wordpress.org: https://plugins.trac.wordpress.org/browser/wordpress-simple-paypal-shopping-cart/tags/5.1.2/wp_shopping_cart.php#L158 plugins.trac.wordpress.org: https://plugins.trac.wordpress.org/browser/wordpress-simple-paypal-shopping-cart/tags/5.1.2/wp_shopping_cart.php#L265 tipsandtricks-hq.com: https://www.tipsandtricks-hq.com/ecommerce/wp-shopping-cart developer.wordpress.org: https://developer.wordpress.org/reference/functions/wp_generate_password/ plugins.trac.wordpress.org: https://plugins.trac.wordpress.org/changeset/3284572/

Credits

Jack Taylor