Is CVE-2026-104641 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-104641 being exploited in the wild.

How severe is CVE-2026-104641?

Medium severity, with a CVSS score of 5.3, published 21 October 2026.

Which products and versions are affected?

Simple Shopping Cart before 5.3.3.

Is there a fix for CVE-2026-104641?

Yes: fixed in 5.3.3. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-104641 attacked?

It is attacked over the network, in a web application.

Am I affected by CVE-2026-104641?

Check whether you run Simple Shopping Cart at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-104641: Simple Shopping Cart payment verification bypass via PayPal IPN

CVE-2026-104641 · Severity: medium · CVSS 5.3 · Published 2026-10-21

The Simple Shopping Cart WordPress plugin is used by site owners to accept payments via PayPal. Before version 5.3.3, the plugin fails to verify that payment notifications are intended for the site owner's PayPal account. An unauthenticated attacker can exploit this to have arbitrary orders marked as paid by sending a notification tied to their own PayPal account, leading to unauthorized access to products or services without paying.

Quick answers

Is CVE-2026-104641 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-104641 being exploited in the wild.
How severe is CVE-2026-104641?: Medium severity, with a CVSS score of 5.3, published 21 October 2026.
Which products and versions are affected?: Simple Shopping Cart before 5.3.3.
Is there a fix for CVE-2026-104641?: Yes: fixed in 5.3.3. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-104641 attacked?: It is attacked over the network, in a web application.
Am I affected by CVE-2026-104641?: Check whether you run Simple Shopping Cart at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

Fixed in: 5.3.3

Technical details

The vulnerability is a payment gateway bypass in the PayPal Instant Payment Notification (IPN) handler that does not validate the receiver's PayPal account email, allowing an unauthenticated attacker to forge payment confirmations. The plugin accepts IPN callbacks without verifying they are addressed to the site owner's account, enabling order status spoofing. A fix is available in version 5.3.3.

Affected products

Simple Shopping Cart before 5.3.3

Timeline

2026-10-19: disclosed
2026-10-21: advisory

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.