CVE-2025-3889

Description

The WordPress Simple Shopping Cart plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 5.1.3 via the 'process_payment_data' due to missing validation on a user controlled key. This makes it possible for unauthenticated attackers to change the quantity of a product to a negative number, which subtracts the product cost from the total order cost. The attack will only work with Manual Checkout mode, as PayPal and Stripe will not process payments for a negative quantity.

Reserved 2025-04-22 | Published 2025-05-01 | Updated 2025-05-01 | Assigner Wordfence

Problem types

CWE-639 Authorization Bypass Through User-Controlled Key

Product status

Default status
unaffected

*
affected

Timeline

2025-04-30:

Disclosed

Credits

Jack Taylor finder

References

www.wordfence.com/...-535e-4a9e-a9b8-1240021a3752?source=cve

plugins.trac.wordpress.org/...ags/5.1.2/wp_shopping_cart.php

www.tipsandtricks-hq.com/ecommerce/wp-shopping-cart

www.tipsandtricks-hq.com/...enabling-manual-offline-checkout

plugins.trac.wordpress.org/changeset/3284572/

cve.org (CVE-2025-3889)

nvd.nist.gov (CVE-2025-3889)

Download JSON