CVE-2026-104641
MEDIUM
NVD
CVSS Score
5.3
Severity
MEDIUM
Published
Oct 21, 2026
Vendor
unknown
Description
The Simple Shopping Cart WordPress plugin before 5.3.3 does not verify that a PayPal payment notification is for a payment received by the site owner's PayPal account in its default configuration, allowing unauthenticated attackers to have their orders marked as paid using a payment made to an account they control.