{"id":"CVE-2026-104642","kind":"vulnerability","aliases":["CVE-2026-104642"],"related":[],"title":"Simple Shopping Cart WordPress plugin lets contributors set product prices","description":"The Simple Shopping Cart WordPress plugin before 5.3.3 does not verify submitted product prices against a value only the site owner can set, allowing users with the Contributor role and above to register attacker-chosen prices for existing products, which any visitor can then use to add those products to the cart at that price.","summary":"The Simple Shopping Cart WordPress plugin before 5.3.3 does not check submitted product prices against the owner-controlled value. A user with the Contributor role or above can set an arbitrary price on an existing product, and any visitor can then buy it at that price.","severity":"low","cvss":2.7,"epss":0.00107,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["ecommerce","package","simple-shopping-cart","wordpress"],"not_affected_if":["plugin-not-installed","version-5.3.3-or-later"],"how_to_check":"- Check the installed version of the Simple Shopping Cart plugin in the WordPress admin Plugins screen, or with `wp plugin get simple-shopping-cart --field=version`\n- Review which accounts hold the Contributor role or higher with `wp user list --role=contributor`","fix":"- Update the Simple Shopping Cart plugin to `5.3.3` or later\n- Review existing product prices for changes you did not make","status":"open","published_at":"2026-10-21T09:17:06+00:00","first_seen_at":"2026-10-23T21:57:28+00:00","triaged_at":"2026-10-25T04:48:00+00:00","updated_at":"2026-10-25T04:48:00+00:00","category":"package","confidence":0.6,"triage":{"at":"2026-10-25T04:48:00Z","model":"claude-haiku-5-5","output":{"fix":"- Update the Simple Shopping Cart plugin to `5.3.3` or later\n- Review existing product prices for changes you did not make","reach":"internet","title":"Simple Shopping Cart WordPress plugin lets contributors set product prices","impact":"medium","summary":"The Simple Shopping Cart WordPress plugin before 5.3.3 does not check submitted product prices against the owner-controlled value. A user with the Contributor role or above can set an arbitrary price on an existing product, and any visitor can then buy it at that price.","category":"package","nicknames":[],"who_cares":["wordpress","ecommerce","simple-shopping-cart"],"confidence":0.6,"needs_auth":"yes","worst_case":"Customers buy products at attacker-chosen prices, causing revenue loss","analyst_note":"","how_to_check":"- Check the installed version of the Simple Shopping Cart plugin in the WordPress admin Plugins screen, or with `wp plugin get simple-shopping-cart --field=version`\n- Review which accounts hold the Contributor role or higher with `wp user list --role=contributor`","needs_analyst":false,"not_affected_if":["plugin-not-installed","version-5.3.3-or-later"],"who_is_affected":"Sites running the Simple Shopping Cart plugin before 5.3.3 that let Contributor-level or higher users edit or submit product data. Sites without this plugin, or running 5.3.3 or later, are not affected.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"low"},"cost_usd":0.000608,"input_tokens":3356,"output_tokens":544,"severity_before":"low"},"analyst_status":null,"analyst_note":null,"search":"'-104642':13A,16A '-2026':12A,15A '5.3.3':31B,78C 'add':118C 'allow':94C 'arbitrari':55B 'attack':105C 'attacker-chosen':104C 'buy':66B 'cart':3A,22B,27B,74C,123C 'check':34B 'chosen':106C 'contributor':7A,48B,98C 'control':42B 'cve':11A,14A 'ecommerc':17B 'exist':59B,109C 'let':6A 'owner':41B,91C 'owner-control':40B 'packag':18B 'plugin':5A,29B,76C 'price':10A,37B,56B,70B,84C,107C,126C 'product':9A,36B,60B,83C,110C,120C 'regist':103C 'role':49B,99C 'set':8A,53B,93C 'shop':2A,21B,26B,73C 'simpl':1A,20B,25B,72C 'simple-shopping-cart':19B 'site':90C 'submit':35B,82C 'use':116C 'user':45B,95C 'valu':43B,87C 'verifi':81C 'visitor':63B,113C 'wordpress':4A,23B,28B,75C","nicknames":[],"mitigations":[],"who_affected":"Sites running the Simple Shopping Cart plugin before 5.3.3 that let Contributor-level or higher users edit or submit product data. Sites without this plugin, or running 5.3.3 or later, are not affected.","tier":"C","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-21T09:17:06+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:L/A:N","cvss_by":"contact@wpscan.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-104642","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-104642","severity":null,"published_at":"2026-10-21T09:17:06+00:00","modified_at":"2026-10-21T18:37:38+00:00","first_seen_at":"2026-10-23T21:57:28+00:00","fetched_at":"2026-10-23T22:29:01+00:00","note":null},{"source":"epss","external_id":"CVE-2026-104642","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-104642","severity":null,"published_at":null,"modified_at":null,"first_seen_at":"2026-10-24T13:15:54+00:00","fetched_at":"2026-10-24T13:15:54+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}