WordPress Simple PayPal Shopping Cart <= 5.1.2 - Unauthenticated Product Price Manipulation
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- None
- Attack complexity
- Low
- Impact type
- —
- Confidentiality · integrity · availability
- None · High · None
- Fix status
- No fix listed
Attack profile from CVSS 3.1 · CNA. Fix status from CNA.
Summary
The WordPress Simple Shopping Cart plugin for WordPress is vulnerable to product price manipulation in all versions up to, and including, 5.1.2. This is due to a logic flaw involving the inconsistent use of parameters during the cart addition process. The plugin uses the parameter 'product_tmp_two' for computing a security hash against price tampering while using 'wspsc_product' to display the product, allowing an unauthenticated attacker to substitute details from a cheaper product and bypass payment for a more expensive item.
Why it matters now
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- Yes
- Technical impact
- Partial
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| mra13 | Simple Shopping Cart | up to 5.1.2 | — | No fix listed | CNA |
- Simple Shopping Cart Vendormra13 Affected up to 5.1.2 Fixed in — No fix listed CNA
CPE names Threatist (inferred) · 1
Inferred from how NVD named this product before; not given by a source.
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:tipsandtricks-hq:wordpress_simple_paypal_shopping_cart:*:*:*:*:*:*:*:* | — | — | mra13 |
- cpe:2.3:a:tipsandtricks-hq:wordpress_simple_paypal_shopping_cart:*:*:*:*:*:*:*:* Versions — — ·mra13
Remediation
No fixed version listed by the sources yet.
Timeline
- 2026-10-02 Threatist record created from CVE-2025-3530
- 2026-10-03 Alias added: GHSA-w4q5-363g-q68q
- 2026-10-24 Priority changed: LOW → MEDIUM
References
Other 7
- https://www.wordfence.com/threat-intel/vulnerabilities/id/e0a3910b-adc4-4633-a6a1-32ba50894be4?source=cve
- https://plugins.trac.wordpress.org/browser/wordpress-simple-paypal-shopping-cart/tags/5.1.2/wp_shopping_cart.php#L171
- https://plugins.trac.wordpress.org/browser/wordpress-simple-paypal-shopping-cart/tags/5.1.2/wp_shopping_cart.php#L156
- https://plugins.trac.wordpress.org/browser/wordpress-simple-paypal-shopping-cart/tags/5.1.2/wp_shopping_cart.php#L165
- https://plugins.trac.wordpress.org/browser/wordpress-simple-paypal-shopping-cart/tags/5.1.2/wp_shopping_cart.php#L261
- https://www.tipsandtricks-hq.com/wordpress-simple-paypal-shopping-cart-plugin-768
- https://plugins.trac.wordpress.org/changeset/3275373/
More mra13 vulnerabilities
- TI-2024-05631 WP eStore < 8.5.5 - Coupon Deletion via CSRF CVSS 3.1HIGH 8.8
- TI-2024-04717 WP eMember < 10.6.6 - Admin+ Arbitrary File Upload CVSS 3.1HIGH 8.8
- TI-2024-04714 WP eMember < 10.6.6 - Bulk Delete via CSRF CVSS 3.1HIGH 8.8
- TI-2024-04422 WP eMember < 10.3.9 - Reflected XSS CVSS 3.1HIGH 8.3
- TI-2022-04146 Compact WP Audio Player < 1.9.8 - Contributor+ Stored XSS CVSS 3.1MEDIUM 5.4
- TI-2024-05309 WP eMember < 10.6.7 - Reflected XSS via Member Edit CVSS 3.1HIGH 7.1
Sources
- CVE-2025-3530 · CVE Program
- CVE-2025-3530 · NVD
- FIRST EPSS
- GHSA-w4q5-363g-q68q · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences