Improper Access Control in Simpler Checkout WordPress Plugin
CVE-2026-121870
Key Information:
- Vendor
WordPress
- Status
- Vendor
- CVE Published:
- 11 November 2026
Badges
What is CVE-2026-121870?
The Simpler Checkout WordPress plugin, prior to version 1.5.4, contains an improper access control vulnerability that allows unauthenticated users to create orders. This occurs because the plugin does not effectively restrict user roles during the order creation process. Additionally, the plugin checks its automatic login link with an unconfigured key, which can allow subscribers to gain administrative access to the store's backend, provided that the store owner has not completed the setup process. Website administrators are encouraged to update to the latest version to mitigate this risk.
Affected Version(s)
Simpler Checkout 0 < 1.5.4
Exploit Proof of Concept (PoC)
PoC code is written by security researchers to demonstrate the vulnerability can be exploited. PoC code is also a key component for weaponization which could lead to ransomware.