Login Request a demo
Medium severity · published May 1, 2025
CVE-2025-3889
WordPress Simple PayPal Shopping Cart <= 5.1.3 - Insecure Direct Object Reference via 'quantity'
5.3
CVSS
0.4%
EPSS
No
On KEV
Description
The WordPress Simple Shopping Cart plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 5.1.3 via the 'process_payment_data' due to missing validation on a user controlled key. This makes it possible for unauthenticated attackers to change the quantity of a product to a negative number, which subtracts the product cost from the total order cost. The attack will only work with Manual Checkout mode, as PayPal and Stripe will not process payments for a negative quantity.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
None
Integrity
Low
Availability
None
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.4% · higher than 30% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
SS
Simple Shopping Cart · mra13
through 5.1.3 · source: vendor
WS
Wordpress Simple Paypal Shopping Cart · Tipsandtricks-hq
before 5.1.4 · source: NVD
Affected product
SS
Simple Shopping Cart
mra13
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2025-3889
CVE.org
https://www.cve.org/CVERecord?id=CVE-2025-3889
Product
https://plugins.trac.wordpress.org/browser/wordpress-simple-paypal-shopping-cart/tags/5.1.2/wp_shopping_cart.php#L324
Patch
https://plugins.trac.wordpress.org/changeset/3284572/
Product
https://www.tipsandtricks-hq.com/ecommerce/simple-shopping-cart-enabling-manual-offline-checkout
Product
https://www.tipsandtricks-hq.com/ecommerce/wp-shopping-cart
Third Party Advisory
https://www.wordfence.com/threat-intel/vulnerabilities/id/41212533-535e-4a9e-a9b8-1240021a3752?source=cve
More from Simple Shopping Cart
8.2
CVE-2025-3529
WordPress Simple PayPal Shopping Cart <= 5.1.2 - Unauthenticated Information Exposure via file_url Parameter
7.5
CVE-2025-3530
WordPress Simple PayPal Shopping Cart <= 5.1.2 - Unauthenticated Product Price Manipulation
6.5
CVE-2025-3874
WordPress Simple PayPal Shopping Cart <= 5.1.3 - Insecure Direct Object Reference
6.4
CVE-2026-0552
Simple Shopping Cart <= 5.2.4 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'wpsc_display_product' Shortcode
6.4
CVE-2024-12622
WordPress Simple Shopping Cart <= 5.0.7 - Authenticated (Contributor+) Stored Cross-Site Scripting