What is GHSA-g546-6f38-794c?

GHSA-g546-6f38-794c is a security advisory published by GitHub Security Advisories with Medium severity. The Simple Shopping Cart WordPress plugin before 5.3.3 does not verify that a PayPal payment...

Which CVE IDs does GHSA-g546-6f38-794c cover?

GHSA-g546-6f38-794c covers the following CVE IDs: CVE-2026-104641. Each CVE has its own detail page on EchelonGraph Pulse with the synthesized EG score.

What is the CVSS v3 score of GHSA-g546-6f38-794c?

GHSA-g546-6f38-794c has a CVSS v3 base score of 5.3, published by GitHub Security Advisories.

GHSA-g546-6f38-794cMediumCVSS 5.3

The Simple Shopping Cart WordPress plugin before 5.3.3 does not verify that a PayPal payment...

Vendor

GitHub Security Advisories

Published

October 21, 2026

Last Modified

October 21, 2026

🔗 CVE IDs covered (1)

CVE-2026-104641 →

📋 Description

The Simple Shopping Cart WordPress plugin before 5.3.3 does not verify that a PayPal payment notification is for a payment received by the site owner's PayPal account in its default configuration, allowing unauthenticated attackers to have their orders marked as paid using a payment made to an account they control.

🔗 References (3)

https://nvd.nist.gov/vuln/detail/CVE-2026-104641
https://wpscan.com/vulnerability/8227f34e-d2ae-4eb4-9984-aeb07d93ed25
https://github.com/advisories/GHSA-g546-6f38-794c