WordPress Plugin Vulnerabilities

Checkimate <= 1.0.13 - Unauthenticated License Deactivation via Hardcoded Secret

Description

The plugin does not properly restrict access to its license-management functionality, relying on a shared secret computed entirely from publicly available information, allowing unauthenticated attackers to deactivate the plugin's premium licensing state and erase the stored license key.

Proof of Concept

Affects Plugins

Plugin icon
checkimate
No known fix

References

CVE
CVE-2026-14829

Classification

Type
ACCESS CONTROLS
OWASP top 10
A5: Broken Access Control
CWE
CWE-284
CVSS
6.5 (medium)

Miscellaneous

Original Researcher
Pedro Pinho
Submitter
Pedro Pinho
Verified
Yes
WPVDB ID
988d296f-9a85-4f6f-876e-c7379c9a3f3c

Timeline

Publicly Published
2026-07-31 (about 6 days ago)
Added
2026-07-31 (about 5 days ago)
Last Updated
2026-07-31 (about 5 days ago)

Other

Published
Title
Published
2021-09-30
Title
JS Job Manager < 1.1.9 - Unauthenticated Arbitrary Plugin Installation/Activation
Published
2026-07-03
Title
WowOptin < 1.4.38 - Unauthenticated Opt-in Deactivation and Template Row Injection
Published
2021-04-20
Title
Redirection for Contact Form 7 < 2.3.4 - Unauthenticated Arbitrary Nonce Generation
Published
2021-03-30
Title
Controlled Admin Access < 1.5.6 - Improper Access Control to Privilege Escalation
Published
2021-06-04
Title
Social Sharing Plugin - Kiwi 2.1.0 - Unauthenticated Arbitrary WordPress Options Update and Read