The WordPress Simple Shopping Cart plugin permits an unauthenticated attacker to alter the 'quantity' parameter in the process_payment_data request. This missing validation allows setting a negative quantity, which reduces the total order cost by the product amount. The flaw does not affect PayPal or Stripe processing, but it is exploitable when the site uses Manual Checkout, enabling the attacker to obtain refunds or fake lower charges.

All installations of the WordPress Simple Shopping Cart plugin up to and including version 5.1.3 on WordPress sites. The affected component is the process_payment_data handler within the plugin. Users of older versions that still allow manual processing are at risk.

The CVSS base score is 5.3, indicating a moderate severity. The EPSS score is below 1 %, suggesting low current exploitation probability, and the vulnerability is not listed in the CISA KEV catalog. However, because the attacker only needs to submit a crafted request and no privileged credentials are required, the attack could be automated if a manual checkout path is enabled. The impact on confidentiality is negligible, but integrity is compromised as an attacker can artificially lower transaction amounts, potentially leading to financial loss or unauthorized refunds.