CVE-2026-121870: high-severity vulnerability in Simpler Checkout
Simpler Checkout < 1.5.4 - Subscriber+ Privilege Escalation via Forged Auto-Login Token
Published
E-mail alert when it lands in KEV, gets a public PoC or its score goes up.
41Vexday Risk Score
No sign of exploitation. It has a public proof of concept.
ssvc Attendcvss 7.5epss 0.3%
The Simpler Checkout WordPress plugin before 1.5.4 does not properly restrict who can create orders and checks its automatic login link with a key that stays empty until the store owner configures the Simpler Checkout WordPress plugin before 1.5.4, allowing subscribers on stores that have not completed setup to log in as an administrator.
CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
Affected products
Unknown · Simpler Checkoutpublic PoCs found — 1
cve_referencewpscan.com/vulnerability/a07c97a1-0faf-43fa-a4c7-0f09937790eb/unverified⚠ Public resources, to assess the exposure of systems you control or are authorized to test. Test only with authorization.