PT-2025-17606 · WordPress · Wordpress Simple Shopping Cart

Jack Taylor · Published 2025-04-23 · Updated 2025-04-28 · CVE-2025-3529

Positive Technologies (AI Summary)

CVSS v3.1

8.2

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:N

Name of the Vulnerable Software and Affected Versions WordPress Simple Shopping Cart plugin versions up to and including 5.1.2

Description The issue allows unauthenticated attackers to access potentially sensitive information and download digital products without paying, through the file url parameter. This enables attackers to view confidential information.

Recommendations For versions up to and including 5.1.2, update to a version higher than 5.1.2 to resolve the issue. As a temporary workaround, consider restricting access to the file url parameter to prevent unauthorized downloads.

Fix

Weakness Enumeration

CWE-201

Related Identifiers

CVE-2025-3529

Affected Products

Wordpress Simple Shopping Cart

References · 14

• https://nvd.nist.gov/vuln/detail/CVE-2025-3529 · Security Note
• https://plugins.trac.wordpress.org/changeset/3275373 · Note
• https://plugins.trac.wordpress.org/browser/wordpress-simple-paypal-shopping-cart/tags/5.1.2/includes/wpsc-shortcodes-related.php#L92 · Note
• https://twitter.com/cracbot/status/1916809678538916232 · Twitter Post
• https://twitter.com/cybercronai/status/1915107290660643164 · Twitter Post
• https://wordfence.com/threat-intel/vulnerabilities/id/8fecc015-518f-4aab-a17e-17cf4b8cf123?source=cve · Note
• https://twitter.com/VulmonFeeds/status/1914966781619208373 · Twitter Post
• https://t.me/cvenotify/119489 · Telegram Post
• https://wordpress.org/plugins/wordpress-simple-paypal-shopping-cart/#developers · Note
• https://twitter.com/CVEnew/status/1914947649280872697 · Twitter Post
• https://t.me/cvedetector/23580 · Telegram Post
• https://twitter.com/vulns_space/status/1914965008997355534 · Twitter Post
• https://tipsandtricks-hq.com/ecommerce/wp-simple-cart-sell-digital-downloads-2468 · Note
• https://t.me/cvetracker/22187 · Telegram Post