WordPress Simple PayPal Shopping Cart < 5.1.3 - Unauthenticated Product Price Manipulation

Description

The plugin is vulnerable to product price manipulation due to a logic flaw involving the inconsistent use of parameters during the cart addition process. The plugin uses the parameter 'product_tmp_two' for computing a security hash against price tampering while using 'wspsc_product' to display the product, allowing an unauthenticated attacker to substitute details from a cheaper product and bypass payment for a more expensive item.