CVE-2025-3530 Details

A vulnerability exists in the WordPress Simple Shopping Cart plugin, affecting all versions up to and including 5.1.2. The issue allows for product price manipulation due to a logic flaw in how parameters are used during the cart addition process. The plugin relies on the 'product_tmp_two' parameter to compute a security hash against price tampering, while the 'wspsc_product' parameter is used to display the product. This inconsistency enables an unauthenticated attacker to replace product details with those from a cheaper item, effectively bypassing payment for a more expensive one.

Users can update to WordPress Simple Shopping Cart version 5.1.3, which addresses this vulnerability by improving the price validation process and adding a dynamic product feature to protect download file URLs.