CVE-2025-3889

The WordPress Simple Shopping Cart plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 5.1.3 via the 'process_payment_data' due to missing validation on a user controlled key. This makes it possible for unauthenticated attackers to change the quantity of a product to a negative number, which subtracts the product cost from the total order cost. The attack will only work with Manual Checkout mode, as PayPal and Stripe will not process payments for a negative quantity.

• CWE-639
• CWE-639

• https://plugins.trac.wordpress.org/browser/wordpress-simple-paypal-shopping-cart/tags/5.1.2/wp_shopping_cart.php#L324Product
• https://plugins.trac.wordpress.org/changeset/3284572/Patch
• https://www.tipsandtricks-hq.com/ecommerce/simple-shopping-cart-enabling-manual-offline-checkoutProduct
• https://www.tipsandtricks-hq.com/ecommerce/wp-shopping-cartProduct
• https://www.wordfence.com/threat-intel/vulnerabilities/id/41212533-535e-4a9e-a9b8-1240021a3752?source=cveThird Party Advisory

Published

May 1, 2025

Last Modified

Jun 17, 2026

Status

Analyzed

• Uncovering a hidden BOLA in Appsmith's snapshot logicStrix autonomously discovered a BOLA/IDOR vulnerability in Appsmith's snapshot deletion path.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2025-3883eCharge Hardy Barth cPH2 index.php Command Injection Remote …8.8
• CVE-2025-3884Cloudera Hue Ace Editor Directory Traversal Information Disc…7.5
• CVE-2025-3885Harman Becker MGU21 Bluetooth Improper Input Validation Deni…6.5
• CVE-2025-3886An issue in CatoNetworks CatoClient before v.5.8.0 allows at…8.1
• CVE-2025-3887GStreamer H265 Codec Parsing Stack-based Buffer Overflow Rem…8.8
• CVE-2025-3888The Jupiter X Core plugin for WordPress is vulnerable to Sto…5.4
• CVE-2025-3890The WordPress Simple Shopping Cart plugin for WordPress is v…5.4
• CVE-2025-3891A flaw was found in the mod_auth_openidc module for Apache h…7.5
• CVE-2025-3892ACAP applications can be executed with elevated privileges, …6.7
• CVE-2025-3893While editing pages managed by MegaBIP a user with high priv…8.6
• CVE-2025-3894Text editor embedded into MegaBIP software does not neutrali…4.8
• CVE-2025-3895Token used for resetting passwords in MegaBIP software are g…9.1