CVE-2026-104642: Simple Shopping Cart 5.1.3 - 5.3.2 - Contributor+ Price Manipulation via Price Verification Bypass
The Simple Shopping Cart WordPress plugin before 5.3.3 does not verify submitted product prices against a value only the site owner can set, allowing users with the Contributor role and above to register attacker-chosen prices for existing products, which any visitor can then use to add those products to the cart at that price.
Affected Software
Event History
Frequently Asked Questions
Which sites are exposed?
Sites using Simple Shopping Cart versions 5.1.3 through 5.3.2 are affected. Exploitation requires an account with the Contributor role or higher, so sites that do not grant those roles to untrusted users have a reduced exposure.
What does an attacker need to do to exploit this issue?
The attacker needs Contributor-level or higher access and an existing product. They can register an attacker-chosen price for that product, after which any visitor can add it to the cart at the manipulated price.
How can I determine whether manipulation may have occurred?
Review product price registrations and cart or order activity for prices that do not match owner-configured product prices. Pay particular attention to activity associated with Contributor or higher accounts.
What can be done before updating?
Limit Contributor and higher roles to trusted users, and review or revoke unnecessary accounts with those permissions. Monitor product price registrations and purchasing activity for unexpected prices.