simplercheckout Simpler Checkout Plugin up to 1.1.9 on WordPress simplerwc_woocommerce_order_created authentication bypass

Summaryinfo

A vulnerability has been found in simplercheckout Simpler Checkout Plugin up to 1.1.9 on WordPress and classified as critical. This affects the function simplerwc_woocommerce_order_created. The manipulation leads to authentication bypass. This vulnerability is documented as CVE-2025-7642. The attack can be initiated remotely. There is not any exploit available. The affected component should be upgraded.

Detailsinfo

A vulnerability was found in simplercheckout Simpler Checkout Plugin up to 1.1.9 on WordPress. It has been rated as critical. This issue affects the function simplerwc_woocommerce_order_created. The manipulation with an unknown input leads to a authentication bypass vulnerability. Using CWE to declare the problem leads to CWE-288. A product requires authentication, but the product has an alternate path or channel that does not require authentication. Impacted is confidentiality, integrity, and availability. The summary by CVE is:

The Simpler Checkout plugin for WordPress is vulnerable to Authentication Bypass in versions 0.7.0 to 1.1.9. This is due to the plugin not properly verifying a user's identity prior to logging them in as an admin through the simplerwc_woocommerce_order_created() function. This makes it possible for unauthenticated attackers to log in as other users based on their order ID, which can be an administrator if a site admin has placed a test order.

The weakness was released by Kenneth Dunn. It is possible to read the advisory at wordfence.com. The identification of this vulnerability is CVE-2025-7642 since 07/14/2025. The exploitation is known to be easy. The attack may be initiated remotely. No form of authentication is needed for a successful exploitation. Technical details of the vulnerability are known, but there is no available exploit.

Upgrading to version 1.1.9 eliminates this vulnerability.

Be aware that VulDB is the high quality source for vulnerability data.

Productinfo

Type

• WordPress Plugin

Vendor

• simplercheckout

Name

• Simpler Checkout Plugin

Version

• 1.1.0
• 1.1.1
• 1.1.2
• 1.1.3
• 1.1.4
• 1.1.5
• 1.1.6
• 1.1.7
• 1.1.8
• 1.1.9

CPE 2.3info

• 🔒
• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Be aware that VulDB is the high quality source for vulnerability data.

Discussion