CVE-2026-104641
The Simple Shopping Cart WordPress plugin before 5.3.3 does not verify that a PayPal payment notification is for a payment received by the s
CVSS
5.3
Medium
EPSS
—
KEV
—
Exploit Today
0
0-100
Published: Oct 21, 2026 · Last modified: Oct 21, 2026
Not enough EPSS history yet.
The Simple Shopping Cart WordPress plugin before 5.3.3 does not verify that a PayPal payment notification is for a payment received by the site owner's PayPal account in its default configuration, allowing unauthenticated attackers to have their orders marked as paid using a payment made to an account they control.
No related CVEs by CWE or product.