CVE-2025-3530 affects the mra13 Simple Shopping Cart WordPress plugin through a logic flaw involving external control of assumed-immutable web parameters (CWE-472). The plugin inconsistently uses the 'product_tmp_two' parameter for security hash computation against price tampering, while the 'wspsc_product' parameter is used for displaying product information. This discrepancy allows an unauthenticated attacker to manipulate the cart by substituting a cheaper product's details, effectively bypassing payment for more expensive items. The vulnerability impacts all versions up to and including 5.1.2. No patch or official fix information is provided in the data.

Successful exploitation allows an unauthenticated attacker to manipulate product prices in the shopping cart, potentially bypassing payment for higher-priced items. This leads to integrity issues in transaction processing and financial loss for merchants using the affected plugin. There is no indication of confidentiality or availability impact. No known exploits in the wild have been reported as of the published date.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no patch or official fix information is provided, users should monitor the vendor's communications for updates. Until a fix is available, consider disabling the plugin or restricting its use to trusted users only to mitigate risk. Avoid relying on the plugin for critical payment processing without additional validation controls.