Logic Flaw in Simple Shopping Cart Plugin for WordPress

CVE-2025-3530

Summary

The Simple Shopping Cart plugin for WordPress contains a logic flaw that allows an attacker to manipulate product prices. This vulnerability arises from the inconsistent use of parameters during the cart addition process. Specifically, while the plugin generates a security hash using the 'product_tmp_two' parameter to prevent price tampering, it displays the product using 'wspsc_product'. This inconsistency enables an unauthenticated attacker to replace product details with those from a less expensive item, thus facilitating payment bypass for higher-priced products. It is crucial for users to ensure they are using the latest version of the plugin to mitigate this risk.

References