CVE-2025-3889

MEDIUM

Tipsandtricks-hq Wordpress Simple Paypal Shopping Cart < 5.1.4 - IDOR

Title source: rule
STIX 2.1

Description

The WordPress Simple Shopping Cart plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 5.1.3 via the 'process_payment_data' due to missing validation on a user controlled key. This makes it possible for unauthenticated attackers to change the quantity of a product to a negative number, which subtracts the product cost from the total order cost. The attack will only work with Manual Checkout mode, as PayPal and Stripe will not process payments for a negative quantity.

References (5)

Core 5

Scores

CVSS v3 5.3
EPSS 0.0027
EPSS Percentile 50.4%
Attack Vector NETWORK
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N

CISA SSVC

Vulnrichment
Exploitation none
Automatable yes
Technical Impact partial

Details

CWE
CWE-639
Status published
Products (2)
mra13/Simple Shopping Cart < 5.1.3
tipsandtricks-hq/wordpress_simple_paypal_shopping_cart < 5.1.4
Published May 01, 2025
Tracked Since Feb 18, 2026