Insecure Direct Object Reference Vulnerability in Simple Shopping Cart Plugin for WordPress

CVE-2025-3874

What is CVE-2025-3874?

The Simple Shopping Cart plugin for WordPress contains a vulnerability that allows unauthenticated attackers to exploit Insecure Direct Object Reference. This issue arises from the absence of randomization in a user-controlled key, enabling unauthorized access to customer shopping carts. Attackers can manipulate product links, add or remove products, and uncover coupon codes, which poses significant risks to both customers and businesses utilizing the plugin. It highlights the need for security measures to safeguard sensitive customer data and maintain the integrity of shopping experiences in vulnerable e-commerce platforms.

References