CVE-2025-3874: WordPress Simple PayPal Shopping Cart <= 5.1.3 - Insecure Direct Object Reference
The WordPress Simple Shopping Cart plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 5.1.3 due to lack of randomization of a user controlled key. This makes it possible for unauthenticated attackers to access customer shopping carts and edit product links, add or delete products, and discover coupon codes.
Affected Software
Remediation
Patch Available
Event History
Frequently Asked Questions
What is the severity of CVE-2025-3874?
CVE-2025-3874 is rated as a high-severity vulnerability due to the potential for unauthorized access to sensitive customer shopping data.
How do I fix CVE-2025-3874?
To fix CVE-2025-3874, update the WordPress Simple Shopping Cart plugin to version 5.1.4 or later.
Who is affected by CVE-2025-3874?
All users of the WordPress Simple Shopping Cart plugin and the WordPress Simple PayPal Shopping Cart plugin up to version 5.1.3 are affected by CVE-2025-3874.
What kind of attacks can be executed due to CVE-2025-3874?
CVE-2025-3874 allows unauthenticated attackers to exploit the vulnerability and access customer shopping information privately.
Is CVE-2025-3874 easily exploitable?
Yes, the lack of randomization in this vulnerability can make it relatively easy for attackers to exploit CVE-2025-3874.