CVE-2025-3874CWE-639

WordPress Simple PayPal Shopping Cart <= 5.1.3 - Insecure Direct Object Reference

Medium · published May 1, 2025

CVSS v3.1
6.5
EPSS
0%
Percentile
33.8
In the wild
Unconfirmed
What it is

The WordPress Simple Shopping Cart plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 5.1.3 due to lack of randomization of a user controlled key. This makes it possible for unauthenticated attackers to access customer shopping carts and edit product links, add or delete products, and discover coupon codes.

The record
Technical detail
CVSS v3.1
6.5 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N
CVSS v4.0
Not supplied
EPSS
0.00407 · 33.8th percentile
Weakness
CWE-639 · Authorization Bypass Through User-Controlled Key
Published
2025-05-01T11:11Z
EPSS history
Timeline
  • 01 MAY 11:11Z
    WordPress Simple PayPal Shopping Cart <= 5.1.3 - Insecure Direct Object Reference
    cvelistv5