Simpler Checkout (< 1.5.4) - CraftedSignal Threat Feedhttps://feed.craftedsignal.io/products/simpler-checkout--1.5.4/Trending threats, MITRE ATT&CK coverage, and detection metadata. Fed continuously.Hugoenhello@craftedsignal.iohello@craftedsignal.ioWed, 11 Nov 2026 13:59:48 +0000https://feed.craftedsignal.io/favicon-32x32.pngCraftedSignal Threat Feedhttps://feed.craftedsignal.io/3232https://feed.craftedsignal.io/favicon.svgSimpler Checkout WordPress plugin: Authentication bypass via unconfigured login link (CVE-2026-121870)https://feed.craftedsignal.io/briefs/2026-11-simpler-checkout-auth-bypass-cve-2026-121870/Wed, 11 Nov 2026 13:59:48 +0000hello@craftedsignal.iohttps://feed.craftedsignal.io/briefs/2026-11-simpler-checkout-auth-bypass-cve-2026-121870/The Simpler Checkout plugin for WordPress prior to 1.5.4 fails to initialize secret keys for automatic login, allowing authenticated subscribers to elevate privileges to administrator.The Simpler Checkout WordPress plugin contains an authentication bypass vulnerability (CVE-2026-121870) due to improper restriction of order creation functionality and an insecure implementation of automatic login links. Until the plugin is manually configured by the store owner, the automatic login key remains empty. This flaw allows low-privileged users, specifically those with 'subscriber' roles, to authenticate as administrators on unconfigured WordPress sites.

Impact

Successful exploitation allows a subscriber-level user to gain administrative privileges on the target WordPress site. This grants full access to site management, plugin settings, and the ability to execute arbitrary administrative actions.

Recommendation

  • Upgrade the Simpler Checkout WordPress plugin to version 1.5.4 or later immediately.
  • Review WordPress user role assignments and audit the administrator list for any unauthorized accounts created or modified since the plugin installation.
  • Verify if the Simpler Checkout plugin has been properly configured in the settings dashboard to ensure the automatic login key is correctly initialized.
]]>highadvisory