CVE-2025-3889: WordPress Simple PayPal Shopping Cart <= 5.1.3 - Insecure Direct Object Reference via 'quantity'
The WordPress Simple Shopping Cart plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 5.1.3 via the 'processpaymentdata' due to missing validation on a user controlled key. This makes it possible for unauthenticated attackers to change the quantity of a product to a negative number, which subtracts the product cost from the total order cost. The attack will only work with Manual Checkout mode, as PayPal and Stripe will not process payments for a negative quantity.
Affected Software
Remediation
Patch Available
Event History
Frequently Asked Questions
What is the severity of CVE-2025-3889?
CVE-2025-3889 has a high severity due to the vulnerability allowing unauthenticated attackers to exploit the lack of validation.
How do I fix CVE-2025-3889?
To fix CVE-2025-3889, update the WordPress Simple Shopping Cart plugin to version 5.1.4 or later.
What versions are affected by CVE-2025-3889?
CVE-2025-3889 affects all versions of WordPress Simple Shopping Cart up to and including 5.1.3.
What type of vulnerability is CVE-2025-3889?
CVE-2025-3889 is classified as an Insecure Direct Object Reference vulnerability.
Can CVE-2025-3889 be exploited remotely?
Yes, CVE-2025-3889 can be exploited remotely by unauthenticated attackers due to insufficient access controls.