Description
The Simple Shopping Cart WordPress plugin before 5.3.3 does not verify that a PayPal payment notification is for a payment received by the site owner's PayPal account in its default configuration, allowing unauthenticated attackers to have their orders marked as paid using a payment made to an account they control.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| — | Simple Shopping Cart | < 5.3.3 | 5.3.3 |
References
- https://wpscan.com/vulnerability/8227f34e-d2ae-4eb4-9984-aeb07d93ed25/ exploit vdb-entry technical-description