---
id: "CVE-2026-121870"
page: "https://infrastack.ai/live/CVE-2026-121870"
kind: "vulnerability"
aliases: ["CVE-2026-121870"]
title: "Simpler Checkout WordPress plugin: subscribers can log in as administrator"
severity: "critical"
cvss: null
epss: null
exploited: false
status: "open"
category: "package"
products: []
ecosystems: []
tags: ["package", "simpler-checkout", "woocommerce", "wordpress"]
not_affected_if: ["plugin-1.5.4-or-later", "setup-completed"]
published_at: "2026-11-11T06:17:17+00:00"
first_seen_at: "2026-11-11T06:25:42+00:00"
updated_at: "2026-11-11T06:27:29+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-121870", "first_seen_at": "2026-11-11T06:25:42+00:00"}]
exploit_sources: []
---

# Simpler Checkout WordPress plugin: subscribers can log in as administrator

Link for people: https://infrastack.ai/live/CVE-2026-121870 (this .md is for agents)

The Simpler Checkout WordPress plugin before 1.5.4 does not restrict who can create orders and checks its automatic login link against a key that stays empty until setup is finished. On stores that have not completed setup, a subscriber account can log in as an administrator.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check the installed Simpler Checkout plugin version in the WordPress admin Plugins screen; versions below `1.5.4` are in scope.
- Check whether the store owner has completed the Simpler Checkout setup; unfinished setup is the condition in the description.

## Fix

- Simpler Checkout WordPress plugin: `1.5.4` or later (the description says 'before 1.5.4').

## Timeline

- 2026-11-11T06:25:42+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-121870

## From the sources

The Simpler Checkout WordPress plugin before 1.5.4 does not properly restrict who can create orders and checks its automatic login link with a key that stays empty until the store owner configures the Simpler Checkout WordPress plugin before 1.5.4, allowing subscribers on stores that have not completed setup to log in as an administrator.

---

_Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai_