---
id: "CVE-2026-104641"
kind: "vulnerability"
aliases: ["CVE-2026-104641"]
title: "WordPress Simple Shopping Cart: forged PayPal notices mark unpaid orders as paid"
severity: "medium"
cvss: 5.3
epss: 0.00114
exploited: false
status: "open"
category: "package"
products: []
ecosystems: []
tags: ["e-commerce", "package", "paypal", "woocommerce-alternatives", "wordpress"]
not_affected_if: ["fixed-version", "paypal-not-enabled", "plugin-not-installed"]
published_at: "2026-10-21T09:17:05+00:00"
first_seen_at: "2026-10-23T21:57:28+00:00"
updated_at: "2026-10-25T04:21:04+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-104641", "first_seen_at": "2026-10-23T21:57:28+00:00"}, {"source": "epss", "url": "https://api.first.org/data/v1/epss?cve=CVE-2026-104641", "first_seen_at": "2026-10-24T13:15:54+00:00"}]
---

# WordPress Simple Shopping Cart: forged PayPal notices mark unpaid orders as paid

The Simple Shopping Cart WordPress plugin before 5.3.3 does not check that a PayPal payment notification is for a payment received by the site owner's PayPal account, in its default configuration. An unauthenticated attacker can pay into an account they control and have their order marked as paid on the store.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check the installed plugin version in the WordPress admin Plugins screen or in `wp-content/plugins/simple-shopping-cart/`, where the version is in the main plugin file header.
- Review recent orders for entries marked paid that have no matching payment in the PayPal account.

## Fix

- Update the Simple Shopping Cart plugin to `5.3.3` or later.
- Reconcile orders marked paid since the update was delayed against PayPal transaction records.

## Timeline

- 2026-10-23T21:57:28+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-104641
- 2026-10-24T13:15:54+00:00 epss https://api.first.org/data/v1/epss?cve=CVE-2026-104641

## From the sources

The Simple Shopping Cart WordPress plugin before 5.3.3 does not verify that a PayPal payment notification is for a payment received by the site owner's PayPal account in its default configuration, allowing unauthenticated attackers to have their orders marked as paid using a payment made to an account they control.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_