Shopping Cart & eCommerce Store <= 6.0.5 - Unauthenticated Order Status Manipulation via Realex Response Handler
- ID
- WPSEC-2026-2158
- Plugin
- WP EasyCart: Shopping Cart and eCommerce Store (wp-easycart)
- Affected
- all versions before 6.0.6
- Remediation
- Update to 6.0.6 or later.
- CVSS 3.1
- CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
- Weakness
- CWE-347
- Usage
- Plugin Low · Affected versions Low among sites WPSec scans, 2026-10-30
- Attack surface
- Shopping Cart & eCommerce Store on WPSec AttackSurface
- Fix released
- Published
Description
The WP EasyCart plugin for WordPress is vulnerable to Improper Verification of Cryptographic Signature via the Realex response handler (ec_page=realex_response) in all versions up to, and including, 6.0.5, due to the handler running on every store whether or not Realex is configured, building its MD5/SHA1 check from the store's Realex shared secret without requiring that a secret is set, and never checking that the targeted order was placed with Realex or was still unpaid. On the default configuration the secret and merchant ID are empty, so the expected hashes can be computed by anyone. This makes it possible for unauthenticated attackers to mark arbitrary orders as paid, which reduces stock and sends receipts and purchased gift cards, or to mark orders as refunded or denied.
References
- https://wpsec.com/vuln/WPSEC-2026-2158/
- https://plugins.svn.wordpress.org/wp-easycart/tags/6.0.6/
- https://wordpress.org/plugins/wp-easycart/
Published by WPSec. Provided as is, without warranty. Corrections: contact us.
This advisory as JSON or Markdown · All advisories: JSON, RSS