The Simple Shopping Cart WordPress plugin, when reduced to any version older than 5.3.3, fails to verify that a PayPal Instant Payment Notification (IPN) corresponds to a transaction paid to the site owner's PayPal account. Because of this oversight, an unauthenticated attacker can send a fabricated IPN for a payment made to an attacker‑controlled PayPal account and cause the plugin to accept the notification as legitimate. The resulting order is marked as paid, allowing the attacker to claim goods or services without completing an authentic transaction. This flaw undermines the integrity of the order handling process and can lead to financial loss or fraudulent activity for the site operator.

All installations of the Simple Shopping Cart WordPress plugin older than version 5.3.3, regardless of host operating system, are impacted. The vulnerability was discovered in the default plugin configuration, which does not require any custom settings.

The vulnerability’s CVSS score of 5.3 indicates moderate impact, primarily affecting the integrity of order status. Because the flaw is exploitable without authentication via a PayPal IPN endpoint that is publicly reachable, the potential for widespread exploitation exists. EPSS information is unavailable, and the vulnerability is not part of the CISA Known Exploited Vulnerabilities catalog. The likely attack path involves crafting a fake PayPal IPN on an attacker‑controlled PayPal account and posting it to the site’s PayPal IPN URL, after which the plugin will unconditionally acknowledge the payment.