Live › vulnerability › CVE-2026-104642
Go to dashboardThe Simple Shopping Cart WordPress plugin before 5.3.3 does not check submitted product prices against the owner-controlled value. A user with the Contributor role or above can set an arbitrary price on an existing product, and any visitor can then buy it at that price.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 21:57 UTC. All times on this page are UTC.
Sites running the Simple Shopping Cart plugin before 5.3.3 that let Contributor-level or higher users edit or submit product data. Sites without this plugin, or running 5.3.3 or later, are not affected.
No product ranges from the sources yet.
wp plugin get simple-shopping-cart --field=versionwp user list --role=contributor5.3.3 or laterEach row is the first time that source carried this signal. The analyst’s rows are its own findings.
The Simple Shopping Cart WordPress plugin before 5.3.3 does not verify submitted product prices against a value only the site owner can set, allowing users with the Contributor role and above to register attacker-chosen prices for existing products, which any visitor can then use to add those products to the cart at that price.
This page as .md · .json · in your agent: get_signal("CVE-2026-104642")
NVD data is provided by NIST and is public domain · EPSS scores by FIRST, used with attribution. Posts quoted belong to their authors.