WordPress Plugin Vulnerabilities

Simpler Checkout < 1.5.4 - Subscriber+ Privilege Escalation via Forged Auto-Login Token

Description

The plugin does not properly restrict who can create orders and checks its automatic login link with a key that stays empty until the store owner configures the plugin, allowing subscribers on stores that have not completed setup to log in as an administrator.

Proof of Concept

Affects Plugins

Plugin icon
simpler-checkout
Fixed in 1.5.4

References

CVE
CVE-2026-121870

Classification

Type
PRIVESC
OWASP top 10
A2: Broken Authentication and Session Management
CWE
CWE-269
CVSS
7.5 (high)

Miscellaneous

Original Researcher
Naoki Kawahigashi
Submitter
Naoki Kawahigashi
Verified
Yes
WPVDB ID
a07c97a1-0faf-43fa-a4c7-0f09937790eb

Timeline

Publicly Published
2026-11-09 (about 2 days ago)
Added
2026-11-09 (about 1 day ago)
Last Updated
2026-11-10 (about 7 hours ago)

Other

Published
Title
Published
2026-02-14
Title
Ecwid by Lightspeed Ecommerce Shopping Cart < 7.0.8 - Subscriber+ Privilege Escalation
Published
2026-09-11
Title
Simple Membership < 4.7.8 - Subscriber+ Membership Level Escalation via PayPal Standard subsc_ref
Published
2025-08-05
Title
Reveal Listing < 3.4 - Unauthenticated Privilege Escalation
Published
2026-03-20
Title
RewardsWP < 1.0.5 - Unauthenticated Privilege Escalation
Published
2026-03-20
Title
App Builder – Create Native Android & iOS Apps On The Flight <= 5.5.10 - Unauthenticated Privilege Escalation via 'role' Parameter