CVE-2026-104641— Simple Shopping Cart < 5.3.3 - Unauthenticated Payment Bypass via Unverified PayPal IPN Recipient
Quick assessment
Affected
Unknown Simple Shopping Cart
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.
Simple Shopping Cart WordPress 插件在 5.3.3 版本之前，其默认配置未验证 PayPal 支付通知是否属于网站所有者 PayPal 账户收到的支付，这使得未认证的攻击者能够将其控制的账户所进行的支付用于将其订单标记为已支付。
Possible ATT&CK Techniques 1 AI
T1190 · Exploit Public-Facing ApplicationAffected Version Matrix 1
| Vendor | Product | Version Range | Status |
|---|---|---|---|
| Unknown | Simple Shopping Cart | < 5.3.3 |
affected |
Get alerts for future matching vulnerabilities
Log in to subscribe
I. Basic Information for CVE-2026-104641
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
Simple Shopping Cart < 5.3.3 - Unauthenticated Payment Bypass via Unverified PayPal IPN Recipient
Source: CVE Program / CVE List V5
Vulnerability Description
The Simple Shopping Cart WordPress plugin before 5.3.3 does not verify that a PayPal payment notification is for a payment received by the site owner's PayPal account in its default configuration, allowing unauthenticated attackers to have their orders marked as paid using a payment made to an account they control.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
Source: CVE Program / CVE List V5
Vulnerability Type
N/A
Source: CVE Program / CVE List V5
Affected Products
| Vendor | Product | Affected Versions | CPE | Subscribe |
|---|---|---|---|---|
| Unknown | Simple Shopping Cart | 0 ~ 5.3.3 | - |
|
II. Public POCs for CVE-2026-104641
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POC
Premium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2026-104641
请登录查看更多情报信息。
Same Patch Batch · Unknown · 2026-10-21 · 53 CVEs total
| CVE-2026-85683 | 8.8 HIGH | Jane Menu < 1.5.1 - Unauthenticated Stored XSS via Store Config Proxy URL |
| CVE-2026-14556 | 5.4 MEDIUM | HappyForms < 1.26.15 - Unauthenticated HTML Injection in Admin Notification Email via clie |
| CVE-2026-107447 | 5.3 MEDIUM | Contest Gallery < 34.0.1 - Unauthenticated Vote Restriction Bypass via Spoofable Client-IP |
| CVE-2026-105256 | 5.3 MEDIUM | LatePoint < 5.7.5 - Unauthenticated Payment Bypass via 'payment_portion' Parameter |
| CVE-2026-103301 | 5.3 MEDIUM | Payment Gateway for Telcell < 2.0.5 - Unauthenticated Payment Confirmation Forgery via Emp |
| CVE-2026-101138 | 5.3 MEDIUM | CMP - Coming Soon & Maintenance 4.1.19 - 4.1.20 - Unauthenticated Maintenance Mode Bypass |
| CVE-2026-104642 | 2.7 LOW | Simple Shopping Cart 5.1.3 - 5.3.2 - Contributor+ Price Manipulation via Price Verificatio |
| CVE-2026-106932 | Moloni < 5.0.14 - Subscriber+ Arbitrary Order Invoice Generation via genInvoice | |
| CVE-2026-110514 | WPZOOM Portfolio < 1.4.34 - Contributor+ Arbitrary Post/Page Type Overwrite via IDOR | |
| CVE-2026-105257 | LatePoint < 5.7.5 - Agent+ Customer PII Disclosure via IDOR | |
| CVE-2026-107127 | Uncanny Toolkit for LearnDash < 3.8.2 - Account Takeover via Password Reset CSRF | |
| CVE-2026-107128 | Uncanny Toolkit for LearnDash < 3.8.2 - Admin+ Cross-Site Account Lockout via Missing Auth | |
| CVE-2026-107788 | SmartyParcel (WC Ukr Shipping) < 1.23.4 - Subscriber+ Arbitrary Shipping Label Deletion | |
| CVE-2026-107790 | WP Job Openings < 4.1.1 - Author+ Stored XSS via Job Title | |
| CVE-2026-107789 | SmartyParcel < 1.23.4 - Unauthenticated Shipping Label Disclosure via IDOR | |
| CVE-2026-108073 | SureCart < 4.9.5 - Unauthenticated Private Catalog Data Disclosure via 'expand' Parameter | |
| CVE-2026-109147 | WP Booking System < 2.1.0.3 - Reflected XSS via 'booking_id' Parameter | |
| CVE-2026-109926 | Productive Commerce < 1.1.49 - Subscriber+ Arbitrary Plugin Activation | |
| CVE-2026-110523 | WP User Manager 2.9.21 - 2.9.25 - Unauthenticated Privilege Escalation via Paid Registrati | |
| CVE-2026-100145 | Synchrony Financing 1.0.5 - 1.1.1 - Unauthenticated Order Takeover via admin_order_callbac |
Showing top 20 of 53 CVEs. View all on vendor page → →
IV. Related Vulnerabilities
Same product: Simple Shopping Cart
-
CVE-2026-104642
Simple Shopping Cart 5.1.3 - 5.3.2 - Contributor+ Price Mani -
CVE-2026-104119
Simple Shopping Cart < 5.2.6 - Admin+ Stored XSS via PayPal -
CVE-2026-48868
WordPress Simple Shopping Cart plugin <= 5.2.9 - Insecure Di -
CVE-2026-0552
Simple Shopping Cart <= 5.2.4 - Authenticated (Contributor+) -
CVE-2025-14248
code-projects Simple Shopping Cart adminlogin.php sql inject
Same vendor: Unknown
-
CVE-2026-85683
Jane Menu < 1.5.1 - Unauthenticated Stored XSS via Store Con -
CVE-2026-14556
HappyForms < 1.26.15 - Unauthenticated HTML Injection in Adm -
CVE-2026-107447
Contest Gallery < 34.0.1 - Unauthenticated Vote Restriction -
CVE-2026-105256
LatePoint < 5.7.5 - Unauthenticated Payment Bypass via 'paym -
CVE-2026-104642
Simple Shopping Cart 5.1.3 - 5.3.2 - Contributor+ Price Mani
V. Comments for CVE-2026-104641
No comments yet