# WP Simple Shopping Cart <= 5.3.2 - Authenticated (Contributor+) Product Price Manipulation via Dynamic Product Registration

- **ID:** WPSEC-2026-0870
- **Plugin:** Simple Shopping Cart (`wordpress-simple-paypal-shopping-cart`), https://wordpress.org/plugins/wordpress-simple-paypal-shopping-cart/
- **Affected versions:** all versions before 5.3.3
- **Fixed in:** 5.3.3 (Update to 5.3.3 or later.)
- **Severity:** Medium 4.3 (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N)
- **Weakness:** CWE-862
- **Usage among sites WPSec scans:** plugin Low, affected versions Low (as of 2026-10-14)
- **Attack surface analysis:** https://attacksurface.wpsec.com/plugin/wordpress-simple-paypal-shopping-cart
- **Fix released:** 2026-10-13
- **Published:** 2026-10-14
- **URL:** https://wpsec.com/vuln/WPSEC-2026-0870/

## Description

The Simple Shopping Cart plugin for WordPress is vulnerable to Product Price Manipulation via the dynamic product registration feature in all versions up to, and including, 5.3.2, due to missing authorization when product name and price pairs from the 'wp_cart_button' shortcode are saved to the stored product data. Any rendered content does this, including drafts and previews, whatever the author's role. This makes it possible for authenticated attackers, with Contributor-level access and above, to register arbitrary prices for existing product names and buy those products at prices of their choosing.

## References

- https://wpsec.com/vuln/WPSEC-2026-0870/
- https://plugins.svn.wordpress.org/wordpress-simple-paypal-shopping-cart/tags/5.3.3/
- https://wordpress.org/plugins/wordpress-simple-paypal-shopping-cart/

Source: WPSec, https://wpsec.com/vuln/WPSEC-2026-0870/

License: CC BY 4.0 (https://creativecommons.org/licenses/by/4.0/). Free to use, share and adapt, also commercially, if you credit WPSec and link to this advisory.