{"id":"CVE-2026-121870","kind":"vulnerability","aliases":["CVE-2026-121870"],"related":[],"title":"Simpler Checkout WordPress plugin: subscribers can log in as administrator","description":"The Simpler Checkout WordPress plugin before 1.5.4 does not properly restrict who can create orders and checks its automatic login link with a key that stays empty until the store owner configures the Simpler Checkout WordPress plugin before 1.5.4, allowing subscribers on stores that have not completed setup to log in as an administrator.","summary":"The Simpler Checkout WordPress plugin before 1.5.4 does not restrict who can create orders and checks its automatic login link against a key that stays empty until setup is finished. On stores that have not completed setup, a subscriber account can log in as an administrator.","severity":"critical","cvss":null,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["package","simpler-checkout","woocommerce","wordpress"],"not_affected_if":["plugin-1.5.4-or-later","setup-completed"],"how_to_check":"- Check the installed Simpler Checkout plugin version in the WordPress admin Plugins screen; versions below `1.5.4` are in scope.\n- Check whether the store owner has completed the Simpler Checkout setup; unfinished setup is the condition in the description.","fix":"- Simpler Checkout WordPress plugin: `1.5.4` or later (the description says 'before 1.5.4').","status":"open","published_at":"2026-11-11T06:17:17+00:00","first_seen_at":"2026-11-11T06:25:42+00:00","triaged_at":"2026-11-11T06:27:29+00:00","updated_at":"2026-11-11T06:27:29+00:00","category":"package","confidence":0.7,"triage":{"at":"2026-11-11T06:27:29Z","model":"claude-haiku-5-5","output":{"fix":"- Simpler Checkout WordPress plugin: `1.5.4` or later (the description says 'before 1.5.4').","reach":"internet","title":"Simpler Checkout WordPress plugin: subscribers can log in as administrator","impact":"high","summary":"The Simpler Checkout WordPress plugin before 1.5.4 does not restrict who can create orders and checks its automatic login link against a key that stays empty until setup is finished. On stores that have not completed setup, a subscriber account can log in as an administrator.","audience":"businesses","category":"package","nicknames":[],"who_cares":["wordpress","woocommerce","simpler-checkout"],"confidence":0.7,"fix_status":"available","needs_auth":"yes","worst_case":"subscriber account gains administrator access on the store","analyst_note":"Confirm from the plugin's changelog or NVD whether the unfinished-setup condition is the only trigger, and whether a stated mitigation exists.","how_to_check":"- Check the installed Simpler Checkout plugin version in the WordPress admin Plugins screen; versions below `1.5.4` are in scope.\n- Check whether the store owner has completed the Simpler Checkout setup; unfinished setup is the condition in the description.\n- unknown","plain_action":"","product_name":"","needs_analyst":true,"not_affected_if":["setup-completed","plugin-1.5.4-or-later"],"who_is_affected":"Stores running the Simpler Checkout WordPress plugin before 1.5.4 that have not completed the plugin's setup. The description ties exposure to an empty key that stays empty until setup is finished, so stores that completed setup are presumably not exposed, but the sources do not state this explicitly. Subscriber accounts on those stores are the entry point.","user_interaction":"no","product_ecosystem":"","needs_special_setup":"yes","severity_if_unknown":"critical"},"cost_usd":0.000784,"input_tokens":4559,"output_tokens":656,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'-121870':13A,16A '-2026':12A,15A '1.5.4':29B,75C,107C 'account':62B 'administr':10A,68B,122C 'allow':108C 'automat':40B,87C 'check':38B,85C 'checkout':2A,20B,25B,71C,103C 'complet':58B,115C 'configur':100C 'creat':35B,82C 'cve':11A,14A 'empti':48B,95C 'finish':52B 'key':45B,92C 'link':42B,89C 'log':7A,64B,118C 'login':41B,88C 'order':36B,83C 'owner':99C 'packag':17B 'plugin':4A,27B,73C,105C 'proper':78C 'restrict':32B,79C 'setup':50B,59B,116C 'simpler':1A,19B,24B,70C,102C 'simpler-checkout':18B 'stay':47B,94C 'store':54B,98C,111C 'subscrib':5A,61B,109C 'woocommerc':21B 'wordpress':3A,22B,26B,72C,104C","nicknames":[],"mitigations":[],"who_affected":"Stores running the Simpler Checkout WordPress plugin before 1.5.4 that have not completed the plugin's setup. The description ties exposure to an empty key that stays empty until setup is finished, so stores that completed setup are presumably not exposed, but the sources do not state this explicitly. Subscriber accounts on those stores are the entry point.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["critical","package","simplercheckout","woocommerce","wordpress"],"campaign_type":null,"search_a":"'-121870':13A,16A '-2026':12A,15A 'administr':10A 'checkout':2A 'cve':11A,14A 'log':7A 'plugin':4A 'simpler':1A 'subscrib':5A 'wordpress':3A","search_b":"'1.5.4':29B 'account':62B 'administr':68B 'automat':40B 'check':38B 'checkout':20B,25B 'complet':58B 'creat':35B 'empti':48B 'finish':52B 'key':45B 'link':42B 'log':64B 'login':41B 'order':36B 'packag':17B 'plugin':27B 'restrict':32B 'setup':50B,59B 'simpler':19B,24B 'simpler-checkout':18B 'stay':47B 'store':54B 'subscrib':61B 'woocommerc':21B 'wordpress':22B,26B","search_c":"'1.5.4':75C,107C 'administr':122C 'allow':108C 'automat':87C 'check':85C 'checkout':71C,103C 'complet':115C 'configur':100C 'creat':82C 'empti':95C 'key':92C 'link':89C 'log':118C 'login':88C 'order':83C 'owner':99C 'plugin':73C,105C 'proper':78C 'restrict':79C 'setup':116C 'simpler':70C,102C 'stay':94C 'store':98C,111C 'subscrib':109C 'wordpress':72C,104C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-11T06:17:17+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-121870","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-121870","severity":null,"published_at":"2026-11-11T06:17:17+00:00","modified_at":"2026-11-11T06:17:17+00:00","first_seen_at":"2026-11-11T06:25:42+00:00","fetched_at":"2026-11-11T06:25:42+00:00","note":null}],"documents":[],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}