The WordPress Simple PayPal Shopping Cart plugin contains a logic flaw that allows an unauthenticated attacker to modify the product price during the cart addition process. By supplying a cheaper product identifier for the security hash parameter while referencing a more expensive product in the display parameter, the attacker can trigger a payment for a higher‑priced item at a lower cost, resulting in financial loss for the site owner and compromising the integrity of the checkout process. The weakness is a missing assignment of an implicit default parameter value, which enables inconsistent behavior between verification and display logic.

This vulnerability applies to WordPress sites that have the mra13 Simple PayPal Shopping Cart plugin installed at version 5.1.2 or earlier. Sites using any earlier release are also affected until they upgrade to a patched version.

The vulnerability has a CVSS score of 7.5, indicating high severity, and an EPSS score of 1%, meaning exploitation is considered possible but currently unlikely, and it is not listed in CISA's KEV catalog. The attack can be performed by sending a crafted HTTP POST request to the cart endpoint with manipulated parameters; authentication is not required, so any visitor can exploit the flaw if the endpoint is publicly accessible.