PT-2025-17607 · WordPress · Wordpress Simple Shopping Cart

Jack Taylor · Published 2025-04-23 · Updated 2025-04-28 · CVE-2025-3530

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

Name of the Vulnerable Software and Affected Versions WordPress Simple Shopping Cart plugin versions up to and including 5.1.2

Description The issue is related to a logic flaw in the plugin's cart addition process, specifically due to the inconsistent use of parameters. The plugin uses the product tmp two parameter for calculating a security hash against price tampering, while using wspsc product to display the product. This inconsistency allows an unauthenticated attacker to substitute details from a cheaper product and bypass payment for a more expensive item.

Recommendations For WordPress Simple Shopping Cart plugin versions up to and including 5.1.2, update to a version later than 5.1.2 to resolve the issue. As a temporary workaround, consider restricting access to the cart addition process to prevent exploitation until a patch is available.

Fix

Weakness Enumeration

CWE-472

Related Identifiers

CVE-2025-3530

Affected Products

Wordpress Simple Shopping Cart

References · 17

• https://nvd.nist.gov/vuln/detail/CVE-2025-3530 · Security Note
• https://t.me/cvetracker/22188 · Telegram Post
• https://plugins.trac.wordpress.org/changeset/3275373 · Note
• https://twitter.com/CVEnew/status/1914947648429441274 · Twitter Post
• https://wordfence.com/threat-intel/vulnerabilities/id/e0a3910b-adc4-4633-a6a1-32ba50894be4?source=cve · Note
• https://t.me/cvedetector/23581 · Telegram Post
• https://tipsandtricks-hq.com/wordpress-simple-paypal-shopping-cart-plugin-768 · Note
• https://plugins.trac.wordpress.org/browser/wordpress-simple-paypal-shopping-cart/tags/5.1.2/wp_shopping_cart.php#L156 · Note
• https://twitter.com/cybercronai/status/1915114858304966775 · Twitter Post
• https://plugins.trac.wordpress.org/browser/wordpress-simple-paypal-shopping-cart/tags/5.1.2/wp_shopping_cart.php#L165 · Note
• https://t.me/cvenotify/119490 · Telegram Post
• https://twitter.com/cracbot/status/1916809680350859319 · Twitter Post
• https://plugins.trac.wordpress.org/browser/wordpress-simple-paypal-shopping-cart/tags/5.1.2/wp_shopping_cart.php#L261 · Note
• https://twitter.com/WolfgangSesin/status/1915018511153299515 · Twitter Post
• https://plugins.trac.wordpress.org/browser/wordpress-simple-paypal-shopping-cart/tags/5.1.2/wp_shopping_cart.php#L171 · Note