Simple Shopping Cart < 5.3.3 – Unauthenticated Payment Bypass via Unverified PayPal IPN Recipient

The plugin does not verify, in its default configuration, that an incoming PayPal IPN notification refers to a payment received by the site owner’s PayPal account. An unauthenticated attacker can pay a small amount to a PayPal account they control and have the resulting notification accepted, marking their order on the target store as paid.

Attackers can obtain products or services without paying the store owner, causing direct financial loss and corrupting order and sales records.