CVE-2026-104642 Simple Shopping Cart CVE debrief

Who should care

WordPress administrators and security teams using Simple Shopping Cart versions 5.1.3 to 5.3.2 should assess exposure and prioritize verification of inventory and compensating controls.

Why it matters

CVE-2026-104642 is a low-severity vulnerability in Simple Shopping Cart WordPress plugin, allowing users with Contributor role and above to manipulate prices. WordPress administrators and security teams should assess exposure, verify inventory, and prioritize remediation.

• Potential price manipulation by users with Contributor role and above
• Possible addition of products to cart at manipulated prices by visitors
• Need for verification of inventory and compensating controls
• Priority for remediation and monitoring of affected versions

Technical summary

The Simple Shopping Cart WordPress plugin before 5.3.3 does not verify submitted product prices against a value only the site owner can set, allowing users with the Contributor role and above to register attacker-chosen prices for existing products. This vulnerability affects WordPress installations using Simple Shopping Cart versions 5.1.3 to 5.3.2, and allows for potential price manipulation by users with Contributor role and above, and possible addition of products to cart at manipulated prices by visitors. The issue arises from the lack of price verification, enabling users with Contributor role and above to manipulate prices.

Defensive priority

Assess exposure and prioritize verification of inventory and compensating controls for WordPress installations using Simple Shopping Cart versions 5.1.3 to 5.3.2.

Recommended defensive actions

• Assess exposure of WordPress installations using Simple Shopping Cart versions 5.1.3 to 5.3.2
• Verify inventory of affected versions and prioritize remediation
• Implement compensating controls to monitor and restrict price changes
• Review and update incident response plans to address potential price manipulation
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up
• Review the supplied official advisory or CVE record to validate affected scope, severity, and vendor guidance
• Plan vendor-supported updates or mitigations through normal change control where exposure is confirmed

Evidence notes

The CVE record and source item provide details on the price manipulation vulnerability in Simple Shopping Cart versions 5.1.3 to 5.3.2, allowing users with the Contributor role and above to register attacker-chosen prices for existing products.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.