Vulnerabilities / WP Simple Shopping Cart / WPSEC-2026-0870
WP Simple Shopping Cart <= 5.3.2 - Authenticated (Contributor+) Product Price Manipulation via Dynamic Product Registration
Medium 4.3
CWE-862Fixed in 5.3.3
- ID
- WPSEC-2026-0870
- Plugin
- Simple Shopping Cart (wordpress-simple-paypal-shopping-cart)
- Affected
- all versions before 5.3.3
- Remediation
- Update to 5.3.3 or later.
- CVSS 3.1
- CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N
- Weakness
- CWE-862
- Usage
- Plugin Low · Affected versions Low among sites WPSec scans, 2026-10-14
- Attack surface
- WP Simple Shopping Cart on WPSec AttackSurface
- Fix released
- Published
Description
The Simple Shopping Cart plugin for WordPress is vulnerable to Product Price Manipulation via the dynamic product registration feature in all versions up to, and including, 5.3.2, due to missing authorization when product name and price pairs from the 'wp_cart_button' shortcode are saved to the stored product data. Any rendered content does this, including drafts and previews, whatever the author's role. This makes it possible for authenticated attackers, with Contributor-level access and above, to register arbitrary prices for existing product names and buy those products at prices of their choosing.
References
- https://wpsec.com/vuln/WPSEC-2026-0870/
- https://plugins.svn.wordpress.org/wordpress-simple-paypal-shopping-cart/tags/5.3.3/
- https://wordpress.org/plugins/wordpress-simple-paypal-shopping-cart/
Published by WPSec. Provided as is, without warranty. Corrections: contact us.
This advisory as JSON or Markdown · All advisories: JSON, RSS