CVE-2025-3529: WordPress Simple Shopping Cart Plugin Flaw

CVE-2025-3529 Overview

CVE-2025-3529 is a sensitive information exposure vulnerability in the WordPress Simple Shopping Cart plugin (wordpress-simple-paypal-shopping-cart). The flaw affects all versions up to and including 5.1.2 and stems from improper handling of the file_url parameter in the related products shortcode. Unauthenticated attackers can retrieve the underlying digital product file URL and download the protected asset without completing a purchase. The weakness is classified as [CWE-201: Insertion of Sensitive Information Into Sent Data]. Because the plugin is used to sell paid digital downloads, exploitation directly bypasses the payment workflow and undermines content monetization on affected WordPress storefronts.

Critical Impact
Unauthenticated remote attackers can extract file_url values and download paid digital products without authorization, resulting in revenue loss and unauthorized distribution of protected content.

Affected Products

WordPress Simple Shopping Cart plugin (wordpress-simple-paypal-shopping-cart) versions up to and including 5.1.2
WordPress sites selling digital downloads through this plugin
E-commerce deployments relying on the plugin's PayPal checkout for paid file delivery

Discovery Timeline

2025-04-23 - CVE-2025-3529 published to NVD
2026-04-15 - Last updated in NVD database

Technical Details for CVE-2025-3529

Vulnerability Analysis

The vulnerability lives in the related-products shortcode logic at includes/wpsc-shortcodes-related.php. When the shortcode renders related items, it exposes the file_url parameter associated with each product. This parameter points to the actual digital asset that buyers should only access after a successful PayPal transaction. Because the URL is emitted directly in the HTML response to unauthenticated visitors, the access control that normally gates the file is effectively bypassed. An attacker can browse a storefront, parse the rendered output, and harvest direct download links for every related paid product. The vendor remediated the issue in changeset 3275373 by removing the unsafe exposure of the URL value.

Root Cause

The root cause is improper output handling in the related-products rendering path. The plugin treats file_url as a public attribute when generating shortcode markup instead of restricting it to post-purchase delivery flows. No authentication, capability check, or purchase verification is enforced before the value is included in the response. This matches the [CWE-201] pattern of sensitive information leaking through normal application output.

Attack Vector

Exploitation is performed over the network without authentication or user interaction. An attacker requests a public page that invokes the related-products shortcode and inspects the returned HTML or DOM for the file_url attribute. The attacker then issues a direct HTTP GET request to the disclosed URL to download the paid digital product. No special tooling beyond a browser or curl is required, which lowers the bar for opportunistic abuse. The vulnerability has an EPSS score of 0.503% (percentile 66.3), reflecting moderate predicted exploitation interest. Technical details are documented in the WordPress Plugin Code Reference and the Wordfence Vulnerability Intel entry.

Detection Methods for CVE-2025-3529

Indicators of Compromise

Unauthenticated HTTP requests to pages rendering the related-products shortcode followed by direct requests to file_url paths
Web server access logs showing successful GET requests to digital product files without prior PayPal IPN or order completion events
Spikes in downloads of paid digital assets that lack corresponding transaction records in the plugin's order table
HTML responses containing exposed file_url attributes when scraped from product listing pages

Detection Strategies

Inspect the rendered HTML of pages using the related-products shortcode for any file_url attribute leakage before patching
Correlate web access logs for direct downloads of files hosted in the plugin's protected upload directories against completed-order records
Deploy a Web Application Firewall (WAF) rule that flags anonymous requests to digital asset paths managed by wordpress-simple-paypal-shopping-cart

Monitoring Recommendations

Enable verbose access logging on the WordPress front-end and retain logs long enough to identify retroactive abuse
Monitor for unusual download volume on paid digital assets, especially from single IP addresses or hosting-provider ranges
Alert on plugin version drift so that hosts still running 5.1.2 or earlier are surfaced in asset inventory

How to Mitigate CVE-2025-3529

Immediate Actions Required

Update the WordPress Simple Shopping Cart plugin to a version newer than 5.1.2 that includes changeset 3275373
Audit web server logs for prior unauthorized downloads of digital products and rotate any leaked download URLs
Move sensitive digital assets out of publicly guessable paths and serve them through an authenticated delivery endpoint

Patch Information

The vendor addressed the issue in WordPress Changeset 3275373, which removes the exposure of file_url from the related-products shortcode output. Site administrators should install the fixed release through the WordPress plugin updater. Plugin metadata and release notes are available on the WordPress Plugin Developer Info page and the Tips and Tricks E-commerce Guide.

Workarounds

Temporarily remove or disable the related-products shortcode on public pages until the plugin is updated
Restrict direct access to digital asset directories using web server rules that require a signed token or session cookie
Replace static file_url values with one-time, expiring download links generated only after a verified purchase

bash

# Example Apache rule to block anonymous access to the plugin's upload directory
<Directory "/var/www/html/wp-content/uploads/wp-simple-cart-uploads">
    Require all denied
</Directory>