CVE-2026-104641 — Simple Shopping Cart < 5.3.3 - Unauthenticated Payment Bypass via Unverified PayPal IPN Recipient

CVE-2026-104641

Simple Shopping Cart < 5.3.3 - Unauthenticated Payment Bypass via Unverified PayPal IPN Recipient PUBLISHED

Description (CNA)

The Simple Shopping Cart WordPress plugin before 5.3.3 does not verify that a PayPal payment notification is for a payment received by the site owner's PayPal account in its default configuration, allowing unauthenticated attackers to have their orders marked as paid using a payment made to an account they control.

Affected (CNA)

Vendor / product	Versions
Unknown / Simple Shopping Cart	affected 0 before 5.3.3

CWE

No CWE identifiers supplied.

References

https://wpscan.com/vulnerability/8227f34e-d2ae-4eb4-9984-aeb07d93ed25/

ADP enrichment

CISA-ADP

No English description supplied.

No references supplied.