CVE-2025-7642: Simpler Checkout 0.7.0 - 1.1.9 - Authentication Bypass
The Simpler Checkout plugin for WordPress is vulnerable to Authentication Bypass in versions 0.7.0 to 1.1.9. This is due to the plugin not properly verifying a user's identity prior to logging them in as an admin through the simplerwcwoocommerceordercreated() function. This makes it possible for unauthenticated attackers to log in as other users based on their order ID, which can be an administrator if a site admin has placed a test order.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2025-7642?
CVE-2025-7642 has a high severity level due to the potential for an authentication bypass that allows unauthorized users to gain admin access.
How do I fix CVE-2025-7642?
To fix CVE-2025-7642, update the Simpler Checkout plugin to version 1.2.0 or later.
What are the affected versions in CVE-2025-7642?
CVE-2025-7642 affects Simpler Checkout versions from 0.7.0 to 1.1.9.
What causes the vulnerability in CVE-2025-7642?
The vulnerability in CVE-2025-7642 is caused by the plugin not properly verifying a user's identity before granting admin access.
Who is the vendor for CVE-2025-7642?
The vendor for CVE-2025-7642 is Simpler Checkout.