CVE-2026-121870: Simpler Checkout < 1.5.4 - Subscriber+ Privilege Escalation via Forged Auto-Login Token
The Simpler Checkout WordPress plugin before 1.5.4 does not properly restrict who can create orders and checks its automatic login link with a key that stays empty until the store owner configures the Simpler Checkout WordPress plugin before 1.5.4, allowing subscribers on stores that have not completed setup to log in as an administrator.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Simpler Checkoutto a version that resolves this vulnerability.Fixed in 1.5.4
Event History
Frequently Asked Questions
Which sites are exposed to administrator takeover?
Stores using Simpler Checkout versions earlier than 1.5.4 are exposed if the plugin setup has not been completed and its automatic-login key remains empty. The issue affects accounts with at least Subscriber privileges.
What does an attacker need to exploit this issue?
The attacker needs a Subscriber-or-higher account on the affected WordPress site. They can create orders and forge the automatic-login token when the plugin key is still empty.
How can I tell whether my site is currently at risk?
Check whether Simpler Checkout is below version 1.5.4 and whether the store owner has completed the plugin configuration. An unconfigured installation with an empty automatic-login key meets the described vulnerable condition.
What can be done if updating is not immediately possible?
Complete the Simpler Checkout configuration so the automatic-login key is no longer empty, and restrict or remove Subscriber access where feasible. Updating to 1.5.4 or later remains necessary to address the affected versions.