CVE-2026-104641
The Simple Shopping Cart WordPress plugin before 5.3.3 does not verify that a PayPal payment notification is for a payment received by the s
CVSS
5.3
Medio
EPSS
—
KEV
—
Exploit Today
0
0-100
Publicado: 21 oct 2026 · Última mod.: 21 oct 2026
Sin historial EPSS suficiente todavía.
The Simple Shopping Cart WordPress plugin before 5.3.3 does not verify that a PayPal payment notification is for a payment received by the site owner's PayPal account in its default configuration, allowing unauthenticated attackers to have their orders marked as paid using a payment made to an account they control.
Sin CVEs relacionados por CWE o producto.