# Shopping Cart & eCommerce Store <= 6.0.5 - Unauthenticated Order Status Manipulation via Realex Response Handler

- **ID:** WPSEC-2026-2158
- **Plugin:** WP EasyCart: Shopping Cart and eCommerce Store (`wp-easycart`), https://wordpress.org/plugins/wp-easycart/
- **Affected versions:** all versions before 6.0.6
- **Fixed in:** 6.0.6 (Update to 6.0.6 or later.)
- **Severity:** High 7.5 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N)
- **Weakness:** CWE-347
- **Usage among sites WPSec scans:** plugin Low, affected versions Low (as of 2026-10-30)
- **Attack surface analysis:** https://attacksurface.wpsec.com/plugin/wp-easycart
- **Fix released:** 2026-10-29
- **Published:** 2026-10-30
- **URL:** https://wpsec.com/vuln/WPSEC-2026-2158/

## Description

The WP EasyCart plugin for WordPress is vulnerable to Improper Verification of Cryptographic Signature via the Realex response handler (ec_page=realex_response) in all versions up to, and including, 6.0.5, due to the handler running on every store whether or not Realex is configured, building its MD5/SHA1 check from the store's Realex shared secret without requiring that a secret is set, and never checking that the targeted order was placed with Realex or was still unpaid. On the default configuration the secret and merchant ID are empty, so the expected hashes can be computed by anyone. This makes it possible for unauthenticated attackers to mark arbitrary orders as paid, which reduces stock and sends receipts and purchased gift cards, or to mark orders as refunded or denied.

## References

- https://wpsec.com/vuln/WPSEC-2026-2158/
- https://plugins.svn.wordpress.org/wp-easycart/tags/6.0.6/
- https://wordpress.org/plugins/wp-easycart/

Source: WPSec, https://wpsec.com/vuln/WPSEC-2026-2158/

License: CC BY 4.0 (https://creativecommons.org/licenses/by/4.0/). Free to use, share and adapt, also commercially, if you credit WPSec and link to this advisory.