Simple Shopping Cart CVE-2026-104642

Exploitation requires an authenticated WordPress account with at least the Contributor role on a site running Simple Shopping Cart before 5.3.3; the attacker abuses the plugin's failure to validate submitted product prices against an owner-only reference value to register arbitrary prices for existing products. The limiting factors are significant: the attacker must already hold a Contributor (or higher) account, so this is not remotely exploitable by an unauthenticated outsider, and impact is confined to manipulating product prices (integrity), with no data disclosure or service disruption. Realistic risk is confined to sites that grant Contributor access to semi-trusted users or that have a compromised/registration-open contributor account.

This is a genuinely low-priority issue despite having multiple corroborating signals, and the CVSS base score of 2.7 is an accurate reflection. The provided CVSS vector (AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:L/A:N) indicates network reach and low complexity but requires privileges and yields only a Low integrity impact with no confidentiality or availability impact. The vendor-assigned PR:H is debatable: the description states the minimum required role is 'Contributor', which in WordPress is a low-privilege authenticated role, not an administrator - so PR:L is arguably more honest, though even that does not materially raise the score. A public exploit exists (POC=YES, reported by WPScan), which is a distinct signal from active exploitation. No EPSS score was provided and the CVE is NOT in CISA KEV, so there is no evidence of real-world exploitation - publicly available exploit code exists, but no public exploitation has been identified. The practical risk is a business-logic / price-tampering flaw: a semi-trusted contributor can set arbitrary product prices that any visitor can then use, enabling fraudulent cheap purchases. Real priority is LOW - this requires an already-authenticated malicious or compromised contributor account and affects a single e-commerce plugin, not a widely exploitable unauthenticated RCE.

A user holding at least the Contributor role (either a legitimate low-trust author or a compromised/registered contributor account) submits a crafted request that registers an attacker-chosen price for an existing product, since the plugin does not validate prices against an owner-only value. Any ordinary visitor can then add that product to their cart at the manipulated (e.g. near-zero) price and check out, causing financial loss to the site owner. A public proof-of-concept documenting the technique is available via WPScan.