PT-2025-34507 · WordPress · Simpler Checkout

Kenneth Dunn · Published 2025-08-23 · Updated 2025-08-23 · CVE-2025-7642

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions: Simpler Checkout versions 0.7.0 through 1.1.9

Description: The Simpler Checkout plugin for WordPress is susceptible to authentication bypass. The plugin does not properly verify a user’s identity before granting access as an administrator through the simplerwc woocommerce order created() function. This allows unauthenticated attackers to log in as other users, potentially including administrators, by exploiting order IDs.

Recommendations: versions prior to 0.7.0 versions after 1.1.9

Fix

Authentication Bypass Using an Alternate Path or Channel

Weakness Enumeration

CWE-288

Related Identifiers

CVE-2025-7642

Affected Products

Simpler Checkout

References · 8

• https://nvd.nist.gov/vuln/detail/CVE-2025-7642 · Security Note
• https://twitter.com/VulmonFeeds/status/1959157185616777644 · Twitter Post
• https://wordfence.com/threat-intel/vulnerabilities/id/02cf0e1a-bd12-44b1-9bc5-1a5ec332b000?source=cve · Note
• https://twitter.com/CveFindCom/status/1959113590629122229 · Twitter Post
• https://t.me/cveNotify/133253 · Telegram Post
• https://plugins.trac.wordpress.org/browser/simpler-checkout/tags/1.1.9/includes/hooks.php#L7 · Note
• https://t.me/CVEtracker/30767 · Telegram Post
• https://twitter.com/CVEnew/status/1959114289266270713 · Twitter Post