Missing authorization in nshowketgmailcom Simple Ecommerce Shopping Cart Plugin- Sell…
Key facts
- Attack vector
- Network
- Privileges required
- Low
- User interaction
- None
- Attack complexity
- Low
- Impact type
- Security bypass
- Confidentiality · integrity · availability
- Low · Low · None
- Fix status
- No fix listed
Attack profile from CVSS 3.1 · CNA. Fix status from CNA. Impact type from CWE-862.
Summary
The Simple Ecommerce Shopping Cart Plugin- Sell products through Paypal plugin for WordPress is vulnerable to unauthorized access due to a missing capability check on the 'save_settings', 'export_csv', and 'simpleecommcart-action' actions in all versions up to, and including, 3.1.2. This makes it possible for authenticated attackers, with subscriber-level access and above, to update the plugins settings and retrieve order and log data (which is also accessible to unauthenticated users).
Why it matters now
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- No
- Technical impact
- Partial
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| nshowketgmailcom | Simple Ecommerce Shopping Cart Plugin- Sell products through Paypal | up to 3.1.2 | — | No fix listed | CNA |
- Simple Ecommerce Shopping Cart Plugin- Sell products through Paypal Vendornshowketgmailcom Affected up to 3.1.2 Fixed in — No fix listed CNA
Remediation
No fixed version listed by the sources yet.
Timeline
- 2026-10-02 Threatist record created from CVE-2024-12253
- 2026-10-03 Alias added: GHSA-g7pv-5fjq-q2xw
References
More nshowketgmailcom vulnerabilities
- TI-2024-11249 Cross-site scripting in nshowketgmailcom Simple Ecommerce Shopping Cart Plugin- Sell… CVSS 3.1MEDIUM 6.1
Sources
- CVE-2024-12253 · CVE Program
- CVE-2024-12253 · NVD
- FIRST EPSS
- GHSA-g7pv-5fjq-q2xw · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences