Vulnerabilities / WP Simple Shopping Cart / WPSEC-2026-0871
WP Simple Shopping Cart <= 5.3.2 - Unauthenticated Payment Bypass via PayPal Standard IPN Receiver Email
Medium 5.3
CWE-345Fixed in 5.3.3
- ID
- WPSEC-2026-0871
- Plugin
- Simple Shopping Cart (wordpress-simple-paypal-shopping-cart)
- Affected
- all versions before 5.3.3
- Remediation
- Update to 5.3.3 or later.
- CVSS 3.1
- CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
- Weakness
- CWE-345
- Usage
- Plugin Low · Affected versions Low among sites WPSec scans, 2026-10-14
- Attack surface
- WP Simple Shopping Cart on WPSec AttackSurface
- Fix released
- Published
Description
The Simple Shopping Cart plugin for WordPress is vulnerable to Payment Bypass via the PayPal Standard IPN handler in all versions up to, and including, 5.3.2, due to the payment's receiver email being compared against the configured merchant PayPal address only when the optional, default-disabled 'Use Strict PayPal Email Address Checking' setting is enabled. This makes it possible for unauthenticated attackers to pay a PayPal account they control and have the resulting PayPal-verified payment notification mark their order as paid, even though the merchant never receives the funds.
References
- https://wpsec.com/vuln/WPSEC-2026-0871/
- https://plugins.svn.wordpress.org/wordpress-simple-paypal-shopping-cart/tags/5.3.3/
- https://wordpress.org/plugins/wordpress-simple-paypal-shopping-cart/
Published by WPSec. Provided as is, without warranty. Corrections: contact us.
This advisory as JSON or Markdown · All advisories: JSON, RSS