The Simple Shopping Cart WordPress plugin, versions 5.1.3 to 5.3.2, lacks price verification for products. Users possessing the Contributor role or higher can submit arbitrary prices for existing products, which are then stored and displayed to all visitors, allowing such visitors to add the items to their carts at the forged price.

Vulnerable versions of the plugin are from 5.1.3 up to but not including 5.3.3. The plugin is distributed for WordPress sites, and the affected systems are any WordPress installations running these versions under any vendor, as the vendor is not specified.

The CVSS score of 2.7 indicates low severity. Exploitation requires authentication within the WordPress site, specifically a user with at least Contributor privileges. Because the EPSS score is unknown and the vulnerability is not in the KEV catalog, the likelihood of widespread exploitation is limited, but the integrity impact on e‑commerce transactions is significant for sites that allow unauthenticated users to add products to the cart with a price set by a Contributor.