The WordPress Simple PayPal Shopping Cart plugin for WordPress suffers from an insecure direct object reference vulnerability. Because the plugin does not randomize a user‑controlled key, an attacker can construct a request that references any shopping cart or product. This allows unauthenticated users to read customer cart contents, modify product links, add or delete products, and discover coupon codes. The weakness aligns with CWE‑639 and directly compromises both confidentiality and integrity of e‑commerce data.

The security issue affects the Simple PayPal Shopping Cart plugin written by mra13, specifically all versions up to and including 5.1.3 that are installed on WordPress sites. Any user running a vulnerable instance, regardless of the WordPress theme or host, is exposed to this flaw.

The CVSS score of 6.5 indicates a medium severity vulnerability. With an EPSS score of less than 1%, current exploitation probability remains low, and the vulnerability is not listed in the CISA KEV catalog. However, the attack requires no authentication and can be carried out by sending a crafted request that includes the predictable key, meaning that a determined attacker could discover or guess keys to access or alter cart information. Because the flaw depends on a direct reference, a site lacking additional controls is especially at risk.