CVE-2026-121870
Simpler Checkout < 1.5.4 - Subscriber+ Privilege Escalation via Forged Auto-Login Token
CVSS Score
0.0
EPSS Score
0.0%
EPSS Percentile
0th
The Simpler Checkout WordPress plugin before 1.5.4 does not properly restrict who can create orders and checks its automatic login link with a key that stays empty until the store owner configures the Simpler Checkout WordPress plugin before 1.5.4, allowing subscribers on stores that have not completed setup to log in as an administrator.
| Vendor | unknown |
| Product | simpler checkout |
| Published | Nov 11, 2026 |
Stay Ahead of the Next One
Get instant alerts for unknown simpler checkout
Be the first to know when new unknown vulnerabilities affecting unknown simpler checkout are published — delivered to Slack, Telegram or Discord.
Get Free Alerts →
Free · No credit card · 60 sec setup
Affected Versions
Unknown / Simpler Checkout
0 < 1.5.4
References
Credits
Naoki Kawahigashi WPScan