CVE-2026-48868: WordPress Simple Shopping Cart plugin <= 5.2.9 - Insecure Direct Object References (IDOR) vulnerability

Synopsis

An Insecure Direct Object Reference (IDOR) vulnerability affects the WordPress Simple Shopping Cart plugin at version 5.2.9 and earlier. The flaw is reachable over the network with no authentication required, meaning any internet user can send crafted requests to an affected WordPress site. Successful exploitation gives an attacker read access to data that should be protected, such as order records, customer details, or other objects managed by the plugin. HarborGuard is tracking the advisory and will make a patched-image rebuild available as soon as the upstream maintainer publishes a fix.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The vulnerable plugin endpoint is exposed over the network, meaning an attacker must be able to reach the WordPress site via HTTP or HTTPS from any internet connection.

• AuthenticationNot required

  No account, session, or credential of any kind is needed to send the malicious request.

• Victim interactionNot required

  The attacker triggers the vulnerability directly through their own request with no action required from a site user or administrator.

• Attack complexityDetail

  Exploit conditions are straightforward and reliable, requiring no race conditions, special memory layout, or environmental preconditions.

Blast Radius

• Attacker reads order records or transaction data belonging to other customers of the WordPress store.
• Attacker reads personally identifiable details such as names, addresses, or email addresses stored in cart or order objects.
• No write or availability impact is indicated; data integrity and service uptime are not directly affected by this vulnerability.