CVE-2026-121870 · Package
NO FIX YET · SEE WHAT TO DO
The Simpler Checkout WordPress plugin before 1.5.4 does not restrict who can create orders and checks its automatic login link against a key that stays empty until setup is finished. On stores that have not completed setup, a subscriber account can log in as an administrator.
first public Nov 11, 2026 · 1 source
Could this affect your app?
Free first check from your website. Connect your repo for the full answer.
Stores running the Simpler Checkout WordPress plugin before 1.5.4 that have not completed the plugin's setup. The description ties exposure to an empty key that stays empty until setup is finished, so stores that completed setup are presumably not exposed, but the sources do not state this explicitly. Subscriber accounts on those stores are the entry point.
Not affected if plugin-1.5.4-or-later, setup-completed
Who cares simpler-checkout, woocommerce, wordpress
1.5.4 are in scope.1.5.4 or later (the description says 'before 1.5.4').The Simpler Checkout WordPress plugin before 1.5.4 does not properly restrict who can create orders and checks its automatic login link with a key that stays empty until the store owner configures the Simpler Checkout WordPress plugin before 1.5.4, allowing subscribers on stores that have not completed setup to log in as an administrator.
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.
Check it with your coding agent
It reads this page and tells you if your code is affected.
Are you affected?
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.