CVE-2026-104642
Low
Description
The Simple Shopping Cart WordPress plugin before 5.3.3 does not verify submitted product prices against a value only the site owner can set, allowing users with the Contributor role and above to register attacker-chosen prices for existing products, which any visitor can then use to add those products to the cart at that price.
SeverityLow
CVSS2.7
Exploit probability—
ProductSimple Shopping Cart
PublishedOct 21, 2026
First seenOct 21, 2026
Weakness typeCWE-345CWE-345
How to fix
Update
- Simple Shopping Cart5.3.3 or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| Simple Shopping Cart | 5.1.3 ≤ v < 5.3.3 | 5.3.3 |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
In the Intelligence 360 plan
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.