CVE-2026-48868
HighCVSS 7.5Exploitation Probability (EPSS)
Low risk20th percentile - higher than 20% of all known CVEs
Summary
Versions of Simple Shopping Cart <= 5.2.9 are vulnerable to unauthenticated Insecure Direct Object References (IDOR). This allows attackers to access resources they should not have access to.
Risk Assessment
Organizations may be exposed to unauthorized access to user data or other sensitive information, potentially leading to loss of customer trust and financial losses.
Recommendation
It is recommended to upgrade to the latest version of Simple Shopping Cart to mitigate this vulnerability and implement proper authorization mechanisms for all object references.
Other vulnerabilities in Simple Shopping Cart
See all- CVE-2026-0552Medium
Stored Cross-Site Scripting (XSS) vulnerability in WordPress Simple Shopping Cart plugin up to version 5.2.4. Through the 'wpsc_display_product' shortcode and user-supplied attributes, attackers with contributor-level access or higher can inject arbitrary scripts that execute when a page is visited.
- CVE-2025-14247Medium
A vulnerability was found in Simple Shopping Cart 1.0 by code-projects in some unknown processing of the file /Admin/additems.php. Manipulation of the argument item_name leads to SQL injection. The attack can be executed remotely and the exploit has been publicly disclosed.
- CVE-2025-14246Medium
A vulnerability was found in Simple Shopping Cart 1.0 by code-projects in unknown code of the file /Customers/settings.php. Manipulation of the argument user_id results in SQL injection. Remote exploitation is possible and the exploit has been made public.
Original NVD description (English source)
Unauthenticated Insecure Direct Object References (IDOR) in Simple Shopping Cart <= 5.2.9 versions.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS