CVE-2026-104641

MEDIUM 5.3

Simple Shopping Cart < 5.3.3 - Unauthenticated Payment Bypass via Unverified PayPal IPN Recipient

CVSS Score

5.3

EPSS Score

0.0%

EPSS Percentile

0th

The Simple Shopping Cart WordPress plugin before 5.3.3 does not verify that a PayPal payment notification is for a payment received by the site owner's PayPal account in its default configuration, allowing unauthenticated attackers to have their orders marked as paid using a payment made to an account they control.

Vendor	unknown
Product	simple shopping cart
Published	Oct 21, 2026

Stay Ahead of the Next One

Get instant alerts for unknown simple shopping cart

Be the first to know when new medium vulnerabilities affecting unknown simple shopping cart are published — delivered to Slack, Telegram or Discord.

Get Free Alerts → Free · No credit card · 60 sec setup

CVSS v3 Breakdown

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N

Attack Vector

Attack Complexity

Privileges Required

User Interaction

Scope

Confidentiality

Integrity

Availability

Affected Versions

Unknown / Simple Shopping Cart

0 < 5.3.3

References

NVD ↗ CVE.org ↗ EPSS Data ↗

wpscan.com: https://wpscan.com/vulnerability/8227f34e-d2ae-4eb4-9984-aeb07d93ed25/

Credits

Mohammed Abd Alrahman WPScan