{
 "id": "WPSEC-2026-2158",
 "url": "https://wpsec.com/vuln/WPSEC-2026-2158/",
 "json_url": "https://wpsec.com/vuln/WPSEC-2026-2158/advisory.json",
 "markdown_url": "https://wpsec.com/vuln/WPSEC-2026-2158/index.md",
 "title": "Shopping Cart & eCommerce Store <= 6.0.5 - Unauthenticated Order Status Manipulation via Realex Response Handler",
 "description": "The WP EasyCart plugin for WordPress is vulnerable to Improper Verification of Cryptographic Signature via the Realex response handler (ec_page=realex_response) in all versions up to, and including, 6.0.5, due to the handler running on every store whether or not Realex is configured, building its MD5/SHA1 check from the store's Realex shared secret without requiring that a secret is set, and never checking that the targeted order was placed with Realex or was still unpaid. On the default configuration the secret and merchant ID are empty, so the expected hashes can be computed by anyone. This makes it possible for unauthenticated attackers to mark arbitrary orders as paid, which reduces stock and sends receipts and purchased gift cards, or to mark orders as refunded or denied.",
 "plugin": {
  "slug": "wp-easycart",
  "name": "Shopping Cart & eCommerce Store",
  "full_name": "WP EasyCart: Shopping Cart and eCommerce Store",
  "wordpress_org": "https://wordpress.org/plugins/wp-easycart/",
  "advisories_url": "https://wpsec.com/vuln/plugin/wp-easycart/",
  "attacksurface": "https://attacksurface.wpsec.com/plugin/wp-easycart"
 },
 "type": "AUTHBYPASS",
 "cwe": [
  "CWE-347"
 ],
 "cve": [],
 "cvss": {
  "version": "3.1",
  "score": 7.5,
  "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N",
  "severity": "High"
 },
 "affected": {
  "ranges": [
   {
    "from": null,
    "from_inclusive": true,
    "to": "6.0.6",
    "to_inclusive": false
   }
  ],
  "text": [
   "all versions before 6.0.6"
  ]
 },
 "introduced_in": null,
 "fixed_in": "6.0.6",
 "remediation": "Update to 6.0.6 or later.",
 "fix_released": "2026-10-29T22:06:57+00:00",
 "published": "2026-10-30T22:49:06+00:00",
 "updated": "2026-10-30T09:32:58.994340+00:00",
 "also_published_as": null,
 "references": [
  "https://wpsec.com/vuln/WPSEC-2026-2158/",
  "https://plugins.svn.wordpress.org/wp-easycart/tags/6.0.6/",
  "https://wordpress.org/plugins/wp-easycart/"
 ],
 "attacksurface_url": "https://attacksurface.wpsec.com/plugin/wp-easycart",
 "source": "WPSec",
 "license": {
  "name": "CC BY 4.0",
  "url": "https://creativecommons.org/licenses/by/4.0/"
 },
 "usage": {
  "plugin": "Low",
  "affected_versions": "Low",
  "as_of": "2026-10-30"
 }
}