CVE-2026-48868 - WordPress Simple Shopping Cart plugin <= 5.2.9 - Insecure Direct Object References (IDOR) vulnerability

HIGH

WordPress Simple Shopping Cart plugin <= 5.2.9 - Insecure Direct Object References (IDOR) vulnerability

Published Jun 15, 2026

7.5

HIGH

CVSS 3.1

EPSS 0.39%

Unauthenticated Insecure Direct Object References (IDOR) in Simple Shopping Cart <= 5.2.9 versions.

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor

Product

Default status

Versions

unaffected

Version	Status	Constraints
-	affected	<=5.2.9

Vendor solution

Update the WordPress Simple Shopping Cart Plugin to the latest available version (at least 5.3.0).

Weaknesses (1)

CWE-639

Authorization Bypass

Link	Providers	Tags
https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-36847		Advisory
https://patchstack.com/database/wordpress/plugin/wordpress-simple-paypal-shopping-cart/vulnerability/wordpress-simple-shopping-cart-plugin-5-2-9-insecure-direct-object-references-idor-vulnerability?_s_id=cve		vdb-entry