CVE-2026-104641: Simple Shopping Cart < 5.3.3 - Unauthenticated Payment Bypass via Unverified PayPal IPN Recipient
The Simple Shopping Cart WordPress plugin before 5.3.3 does not verify that a PayPal payment notification is for a payment received by the site owner's PayPal account in its default configuration, allowing unauthenticated attackers to have their orders marked as paid using a payment made to an account they control.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Simple Shopping Cartto a version that resolves this vulnerability.Fixed in 5.3.3
Event History
Frequently Asked Questions
Which installations are affected?
Simple Shopping Cart installations running a version before 5.3.3 are affected. The issue is present in the plugin's default configuration.
What does an attacker need to exploit this issue?
An attacker does not need authentication or user interaction. They can make a PayPal payment to an account they control and use the resulting notification to cause an order to be marked as paid.
What is the practical impact on a vulnerable store?
Orders can be marked as paid even though the site owner did not receive the corresponding payment. This can allow attackers to obtain goods or services without paying the store owner.