# WP Simple Shopping Cart <= 5.3.2 - Unauthenticated Payment Bypass via PayPal Standard IPN Receiver Email

- **ID:** WPSEC-2026-0871
- **Plugin:** Simple Shopping Cart (`wordpress-simple-paypal-shopping-cart`), https://wordpress.org/plugins/wordpress-simple-paypal-shopping-cart/
- **Affected versions:** all versions before 5.3.3
- **Fixed in:** 5.3.3 (Update to 5.3.3 or later.)
- **Severity:** Medium 5.3 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N)
- **Weakness:** CWE-345
- **Usage among sites WPSec scans:** plugin Low, affected versions Low (as of 2026-10-14)
- **Attack surface analysis:** https://attacksurface.wpsec.com/plugin/wordpress-simple-paypal-shopping-cart
- **Fix released:** 2026-10-13
- **Published:** 2026-10-14
- **URL:** https://wpsec.com/vuln/WPSEC-2026-0871/

## Description

The Simple Shopping Cart plugin for WordPress is vulnerable to Payment Bypass via the PayPal Standard IPN handler in all versions up to, and including, 5.3.2, due to the payment's receiver email being compared against the configured merchant PayPal address only when the optional, default-disabled 'Use Strict PayPal Email Address Checking' setting is enabled. This makes it possible for unauthenticated attackers to pay a PayPal account they control and have the resulting PayPal-verified payment notification mark their order as paid, even though the merchant never receives the funds.

## References

- https://wpsec.com/vuln/WPSEC-2026-0871/
- https://plugins.svn.wordpress.org/wordpress-simple-paypal-shopping-cart/tags/5.3.3/
- https://wordpress.org/plugins/wordpress-simple-paypal-shopping-cart/

Source: WPSec, https://wpsec.com/vuln/WPSEC-2026-0871/

License: CC BY 4.0 (https://creativecommons.org/licenses/by/4.0/). Free to use, share and adapt, also commercially, if you credit WPSec and link to this advisory.