← Back

CVE-2025-3889

nvd nist
Published: May 1, 2025Modified: May 6, 2025

JSON object

Loading...
5.3
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
Exploitability: 3.9 / Impact: 1.4
Source: NVD

Description

The WordPress Simple Shopping Cart plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 5.1.3 via the 'process_payment_data' due to missing validation on a user controlled key. This makes it possible for unauthenticated attackers to change the quantity of a product to a negative number, which subtracts the product cost from the total order cost. The attack will only work with Manual Checkout mode, as PayPal and Stripe will not process payments for a negative quantity.

Affected (1)

Tipsandtricks Hq
1 product
Wordpress Simple Paypal Shopping Cart
Configuration A
1 vulnerable
Vulnerable SoftwareAffected Versions
Wordpress Simple Paypal Shopping Cart
Before 5.1.4

Related CWEs

CWE-639
Authorization Bypass Through User-Controlled Key
The system's authorization functionality does not prevent one user from gaining access to another user's data or record by modifying the key value identifying the data.

References (5)

Source: security@wordfence.com
Product
Source: security@wordfence.com
Patch
Source: security@wordfence.com
Product
Source: security@wordfence.com
Product
Source: security@wordfence.com
Third Party Advisory

Timeline

No history available yet.