PT-2025-18383 · WordPress · Wordpress Simple Shopping Cart

Jack Taylor · Published 2025-05-01 · Updated 2025-05-06 · CVE-2025-3889

Positive Technologies (AI Summary)

CVSS v3.1

5.3

Medium

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N

Name of the Vulnerable Software and Affected Versions WordPress Simple Shopping Cart plugin versions up to, and including, 5.1.3

Description The issue allows unauthenticated attackers to manipulate the quantity of a product to a negative number, effectively subtracting the product cost from the total order cost. This is possible due to missing validation on a user-controlled key in the process payment data function. The attack is limited to Manual Checkout mode, as payment processors like PayPal and Stripe do not process payments for negative quantities.

Recommendations For WordPress Simple Shopping Cart plugin versions up to, and including, 5.1.3, consider disabling the Manual Checkout mode until a patch is available to prevent exploitation. Additionally, restrict access to the process payment data function to minimize the risk of negative quantity manipulation.

Fix

IDOR

Weakness Enumeration

CWE-639

Related Identifiers

CVE-2025-3889

Affected Products

Wordpress Simple Shopping Cart

References · 11

• https://plugins.trac.wordpress.org/changeset/3284572 · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2025-3889 · Security Note
• https://osv.dev/vulnerability/CVE-2025-3889 · Vendor Advisory
• https://twitter.com/dailycve/status/1919804156522443245 · Twitter Post
• https://t.me/cvenotify/120465 · Telegram Post
• https://twitter.com/VulmonFeeds/status/1917929854516814221 · Twitter Post
• https://tipsandtricks-hq.com/ecommerce/wp-shopping-cart · Note
• https://wordfence.com/threat-intel/vulnerabilities/id/41212533-535e-4a9e-a9b8-1240021a3752?source=cve · Note
• https://plugins.trac.wordpress.org/browser/wordpress-simple-paypal-shopping-cart/tags/5.1.2/wp_shopping_cart.php#L324 · Note
• https://twitter.com/CVEnew/status/1917903770643575071 · Twitter Post
• https://tipsandtricks-hq.com/ecommerce/simple-shopping-cart-enabling-manual-offline-checkout · Note