WordPress Plugin Vulnerabilities
Simple Shopping Cart < 5.3.3 - Unauthenticated Payment Bypass via Unverified PayPal IPN Recipient
Description
The plugin does not verify that a PayPal payment notification is for a payment received by the site owner's PayPal account in its default configuration, allowing unauthenticated attackers to have their orders marked as paid using a payment made to an account they control.
Proof of Concept
Affects Plugins
Fixed in 5.3.3 References
CVE
Miscellaneous
Original Researcher
Mohammed Abd Alrahman
Submitter
Mohammed Abd Alrahman
Submitter website
Verified
Yes
WPVDB ID
Timeline
Publicly Published
2026-10-19 (about 2 days ago)
Added
2026-10-19 (about 1 day ago)
Last Updated
2026-10-19 (about 1 day ago)
