Authentication Bypass in Simple Payment Plugin for WordPress

CVE-2025-6688

What is CVE-2025-6688?

The Simple Payment plugin for WordPress contains a critical vulnerability allowing unauthenticated attackers to log in as administrative users. This issue arises from the inadequate verification of user identities during the login process utilizing the create_user() function. Versions 1.3.6 to 2.3.8 are particularly affected, which exposes sites to significant security risks if left unaddressed. Admins should update to the latest version immediately to remediate this vulnerability and protect sensitive site functions.

References