{"id":"CVE-2026-104641","kind":"vulnerability","aliases":["CVE-2026-104641"],"related":[],"title":"WordPress Simple Shopping Cart: forged PayPal notices mark unpaid orders as paid","description":"The Simple Shopping Cart WordPress plugin before 5.3.3 does not verify that a PayPal payment notification is for a payment received by the site owner's PayPal account in its default configuration, allowing unauthenticated attackers to have their orders marked as paid using a payment made to an account they control.","summary":"The Simple Shopping Cart WordPress plugin before 5.3.3 does not check that a PayPal payment notification is for a payment received by the site owner's PayPal account, in its default configuration. An unauthenticated attacker can pay into an account they control and have their order marked as paid on the store.","severity":"medium","cvss":5.3,"epss":0.00114,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["e-commerce","package","paypal","woocommerce-alternatives","wordpress"],"not_affected_if":["fixed-version","paypal-not-enabled","plugin-not-installed"],"how_to_check":"- Check the installed plugin version in the WordPress admin Plugins screen or in `wp-content/plugins/simple-shopping-cart/`, where the version is in the main plugin file header.\n- Review recent orders for entries marked paid that have no matching payment in the PayPal account.","fix":"- Update the Simple Shopping Cart plugin to `5.3.3` or later.\n- Reconcile orders marked paid since the update was delayed against PayPal transaction records.","status":"open","published_at":"2026-10-21T09:17:05+00:00","first_seen_at":"2026-10-23T21:57:28+00:00","triaged_at":"2026-10-25T04:21:04+00:00","updated_at":"2026-10-25T04:21:04+00:00","category":"package","confidence":0.7,"triage":{"at":"2026-10-25T04:21:04Z","model":"claude-haiku-5-5","output":{"fix":"- Update the Simple Shopping Cart plugin to `5.3.3` or later.\n- Reconcile orders marked paid since the update was delayed against PayPal transaction records.","reach":"internet","title":"WordPress Simple Shopping Cart: forged PayPal notices mark unpaid orders as paid","impact":"medium","summary":"The Simple Shopping Cart WordPress plugin before 5.3.3 does not check that a PayPal payment notification is for a payment received by the site owner's PayPal account, in its default configuration. An unauthenticated attacker can pay into an account they control and have their order marked as paid on the store.","category":"package","nicknames":[],"who_cares":["wordpress","woocommerce-alternatives","paypal","e-commerce"],"confidence":0.7,"needs_auth":"no","worst_case":"Unpaid orders get marked as paid without payment.","analyst_note":"","how_to_check":"- Check the installed plugin version in the WordPress admin Plugins screen or in `wp-content/plugins/simple-shopping-cart/`, where the version is in the main plugin file header.\n- Review recent orders for entries marked paid that have no matching payment in the PayPal account.","needs_analyst":false,"not_affected_if":["plugin-not-installed","paypal-not-enabled","fixed-version"],"who_is_affected":"Sites running the Simple Shopping Cart WordPress plugin before 5.3.3 with PayPal payments enabled in the default configuration. Sites that do not use the plugin's PayPal integration, or that run a fixed version, can skip it. The sources do not say whether the flaw is reachable on sites with non-default settings.","user_interaction":"no","needs_special_setup":"no","severity_if_unknown":"medium"},"cost_usd":0.000641,"input_tokens":3361,"output_tokens":610,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-104641':15A,18A '-2026':14A,17A '5.3.3':35B,87C 'account':55B,67B,107C,128C 'allow':112C 'altern':26B 'attack':62B,114C 'cart':4A,31B,83C 'check':38B 'commerc':21B 'configur':59B,111C 'control':69B,130C 'cve':13A,16A 'default':58B,110C 'e':20B 'e-commerc':19B 'forg':5A 'made':125C 'mark':8A,74B,119C 'notic':7A 'notif':43B,95C 'order':10A,73B,118C 'owner':52B,104C 'packag':22B 'paid':12A,76B,121C 'pay':64B 'payment':42B,47B,94C,99C,124C 'paypal':6A,23B,41B,54B,93C,106C 'plugin':33B,85C 'receiv':48B,100C 'shop':3A,30B,82C 'simpl':2A,29B,81C 'site':51B,103C 'store':79B 'unauthent':61B,113C 'unpaid':9A 'use':122C 'verifi':90C 'woocommerc':25B 'woocommerce-altern':24B 'wordpress':1A,27B,32B,84C","nicknames":[],"mitigations":[],"who_affected":"Sites running the Simple Shopping Cart WordPress plugin before 5.3.3 with PayPal payments enabled in the default configuration. Sites that do not use the plugin's PayPal integration, or that run a fixed version, can skip it. The sources do not say whether the flaw is reachable on sites with non-default settings.","tier":"C","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-21T09:17:05+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N","cvss_by":"contact@wpscan.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-104641","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-104641","severity":null,"published_at":"2026-10-21T09:17:05+00:00","modified_at":"2026-10-21T18:37:38+00:00","first_seen_at":"2026-10-23T21:57:28+00:00","fetched_at":"2026-10-23T22:29:01+00:00","note":null},{"source":"epss","external_id":"CVE-2026-104641","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-104641","severity":null,"published_at":null,"modified_at":null,"first_seen_at":"2026-10-24T13:15:54+00:00","fetched_at":"2026-10-24T13:15:54+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}