{"id":"CVE-2026-104642","title":"Simple Shopping Cart 5.1.3 - 5.3.2 - Contributor+ Price Manipulation via Price Verification Bypass","summary":"The Simple Shopping Cart WordPress plugin before 5.3.3 does not verify submitted product prices against a value only the site owner can set, allowing users with the Contributor role and above to register attacker-chosen prices for existi…","severity":"low","cvss":2.7,"cvssVector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:L/A:N","cvssSource":"cna","cwe":["CWE-345"],"product":"Simple Shopping Cart","affected":["simple_shopping_cart >= 5.1.3 < 5.3.3"],"ssvc":{"exploitation":"none","automatable":"no","technicalImpact":"partial","timestamp":"2026-10-21T10:11:47.790144Z"},"published":"2026-10-21","updated":"2026-10-21","sourceUpdated":"2026-10-21T10:14:55.356Z","source":"CVEORG","sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2026-104642","references":[{"url":"https://wpscan.com/vulnerability/f6f0db1e-4a25-402c-9c23-bf30909570b3/"}],"tags":["cve.org"],"ingestedAt":"2026-10-21T09:46:15.401Z","slug":"CVE-2026-104642","body":"## Overview\n\nThe Simple Shopping Cart WordPress plugin before 5.3.3 does not verify submitted product prices against a value only the site owner can set, allowing users with the Contributor role and above to register attacker-chosen prices for existing products, which any visitor can then use to add those products to the cart at that price.\n\n## Affected\n\n- `simple_shopping_cart >= 5.1.3 < 5.3.3`\n\n## Remediation\n\nRefer to the linked advisories for vendor-supplied fixes and affected version ranges.","depth":"sunlit","depthScore":15,"depthScoreParts":{"impact":14.9,"likelihood":0,"exploitation":0,"ransomware":0},"changes":[]}