Live › vulnerability › CVE-2026-104641
Go to dashboardThe Simple Shopping Cart WordPress plugin before 5.3.3 does not check that a PayPal payment notification is for a payment received by the site owner's PayPal account, in its default configuration. An unauthenticated attacker can pay into an account they control and have their order marked as paid on the store.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 21:57 UTC. All times on this page are UTC.
Sites running the Simple Shopping Cart WordPress plugin before 5.3.3 with PayPal payments enabled in the default configuration. Sites that do not use the plugin's PayPal integration, or that run a fixed version, can skip it. The sources do not say whether the flaw is reachable on sites with non-default settings.
No product ranges from the sources yet.
wp-content/plugins/simple-shopping-cart/, where the version is in the main plugin file header.5.3.3 or later.Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
The Simple Shopping Cart WordPress plugin before 5.3.3 does not verify that a PayPal payment notification is for a payment received by the site owner's PayPal account in its default configuration, allowing unauthenticated attackers to have their orders marked as paid using a payment made to an account they control.
This page as .md · .json · in your agent: get_signal("CVE-2026-104641")
NVD data is provided by NIST and is public domain · EPSS scores by FIRST, used with attribution. Posts quoted belong to their authors.