Simple Shopping Cart CVE-2026-104641

Exploitable against the plugin's DEFAULT configuration: the vulnerability is that the plugin does not validate that the PayPal payment notification corresponds to a payment received by the site owner's PayPal account, so an attacker can satisfy an order using a payment made to their OWN PayPal account. Required prerequisites: the target site must run Simple Shopping Cart before 5.3.3 with its PayPal payment/IPN flow in use for live orders. Limiting factors: the attacker must actually complete a (self-benefiting) PayPal transaction and get the notification delivered to the site, and impact is confined to fraudulently marking orders paid (integrity only) - it grants no data access, code execution, or availability impact. No authentication or user interaction is needed (PR:N/UI:N).

This is a moderate-risk business-logic flaw whose signals are internally consistent rather than conflicting. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N) confirms a remote, low-complexity, unauthenticated path, and the 5.3 Medium score is driven entirely by Integrity (I:L) with no Confidentiality or Availability impact - matching a payment-validation bypass where an attacker falsifies order-paid status rather than stealing data or crashing the service. Public exploit code exists (reported by WPScan), which raises practical exploitability, but there is NO CISA KEV listing and NO EPSS score was provided, so there is no evidence of active, widespread exploitation - exploitation is a tangible possibility but not confirmed in the wild. The real-world priority is tempered by the limited impact (financial/fraud loss to the site owner, not system compromise) and the fact that it only matters for sites actually selling goods via the plugin's PayPal integration; for an e-commerce operator this is a meaningful fraud risk, while for the broader WordPress population it is a lower-urgency, single-vendor issue. Note: CWE is listed as N/A and the 'Information Disclosure' tag conflicts with the C:N vector - treat this as an improper-authorization/payment-fraud issue, not a data-disclosure one.

An attacker places an order on a victim store running the vulnerable plugin, then completes a real PayPal payment into a PayPal account they themselves control and causes the resulting IPN/payment notification to reach the victim site. Because the plugin (in its default configuration) does not verify that the payment was received by the site owner's PayPal account, the order is marked as paid and digital goods or fulfillment are released without the merchant ever receiving funds. Public exploit details are available via WPScan, lowering the skill barrier.