CVSS base score
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N
What the vulnerability does
The WordPress Simple Shopping Cart plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 5.1.3 due to lack of randomization of a user controlled key. This makes it possible for unauthenticated attackers to access customer shopping carts and edit product links, add or delete products, and discover coupon codes.
Explanation of Vulnerability in Simple Terms
Simple Shopping Cart versions 5.1.3 and earlier contain an authorization flaw that allows unauthenticated attackers to read and modify sensitive data over the network. The vulnerability requires no user interaction and can be exploited remotely. Site administrators should update to a version newer than 5.1.3 immediately.
What an attacker can do
Read and modify sensitive shopping cart data without authentication.
Potential impact on your site
Customer data and cart contents can be viewed or altered by anyone on the internet.
Conditions required to exploit
Network access to the affected site; no authentication or user interaction required.
Key dates
External resources
