The WordPress Simple Shopping Cart plugin is affected by a vulnerability that allows sensitive information disclosure through the file_url parameter. This flaw enables attackers who do not have authentication credentials to access and download files or digital products that the plugin serves, potentially exposing private data or permitting unauthorized purchases.

All installations of the WordPress Simple Shopping Cart plugin with a version equal to or earlier than 5.1.2 are affected. The issue resides in the handling of the file_url parameter inside the plugin’s code, which does not enforce any access checks before allowing the download or exposure of a requested file.

The CVSS score of 8.2 places this issue in the high severity range, while the EPSS score of less than 1% suggests a low probability of widespread exploitation at this time. The vulnerability is not listed in the CISA KEV catalog. Based on the description, it is inferred that an attacker can trigger the exposure by crafting a URL that includes a file_url parameter pointing to the desired file, thereby executing the flaw without site credentials.