{
 "id": "WPSEC-2026-0871",
 "url": "https://wpsec.com/vuln/WPSEC-2026-0871/",
 "json_url": "https://wpsec.com/vuln/WPSEC-2026-0871/advisory.json",
 "markdown_url": "https://wpsec.com/vuln/WPSEC-2026-0871/index.md",
 "title": "WP Simple Shopping Cart <= 5.3.2 - Unauthenticated Payment Bypass via PayPal Standard IPN Receiver Email",
 "description": "The Simple Shopping Cart plugin for WordPress is vulnerable to Payment Bypass via the PayPal Standard IPN handler in all versions up to, and including, 5.3.2, due to the payment's receiver email being compared against the configured merchant PayPal address only when the optional, default-disabled 'Use Strict PayPal Email Address Checking' setting is enabled. This makes it possible for unauthenticated attackers to pay a PayPal account they control and have the resulting PayPal-verified payment notification mark their order as paid, even though the merchant never receives the funds.",
 "plugin": {
  "slug": "wordpress-simple-paypal-shopping-cart",
  "name": "WP Simple Shopping Cart",
  "full_name": "Simple Shopping Cart",
  "wordpress_org": "https://wordpress.org/plugins/wordpress-simple-paypal-shopping-cart/",
  "advisories_url": "https://wpsec.com/vuln/plugin/wordpress-simple-paypal-shopping-cart/",
  "attacksurface": "https://attacksurface.wpsec.com/plugin/wordpress-simple-paypal-shopping-cart"
 },
 "type": "BYPASS",
 "cwe": [
  "CWE-345"
 ],
 "cve": [],
 "cvss": {
  "version": "3.1",
  "score": 5.3,
  "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N",
  "severity": "Medium"
 },
 "affected": {
  "ranges": [
   {
    "from": null,
    "from_inclusive": true,
    "to": "5.3.3",
    "to_inclusive": false
   }
  ],
  "text": [
   "all versions before 5.3.3"
  ]
 },
 "introduced_in": null,
 "fixed_in": "5.3.3",
 "remediation": "Update to 5.3.3 or later.",
 "fix_released": "2026-10-13T05:57:37+00:00",
 "published": "2026-10-14T06:44:31+00:00",
 "updated": "2026-10-13T12:12:56.224495+00:00",
 "also_published_as": null,
 "references": [
  "https://wpsec.com/vuln/WPSEC-2026-0871/",
  "https://plugins.svn.wordpress.org/wordpress-simple-paypal-shopping-cart/tags/5.3.3/",
  "https://wordpress.org/plugins/wordpress-simple-paypal-shopping-cart/"
 ],
 "attacksurface_url": "https://attacksurface.wpsec.com/plugin/wordpress-simple-paypal-shopping-cart",
 "source": "WPSec",
 "license": {
  "name": "CC BY 4.0",
  "url": "https://creativecommons.org/licenses/by/4.0/"
 },
 "usage": {
  "plugin": "Low",
  "affected_versions": "Low",
  "as_of": "2026-10-14"
 }
}