Back to feed
EUVD-2025-19376 · Published Jun 27, 2025
The Simple Payment plugin for WordPress is vulnerable to Authentication Bypass in versions 1.3.6 to 2.3.8. This is due to the plugin not properly verifying a user's identity prior to logging them in through the create_user() function. This makes it possible for unauthenticated attackers to log in as administrative users.
Technologies
Idokd Simple Payment
Weaknesses
CWE-288
CVSS scores
- v3.19.8
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
MITRE ATT&CK
InferredWhere this vulnerability fits in an attack
Initial Access Persistence Stealth Defense Impairment Credential Access Discovery
References
Potentially impacted assets
See if this affects your attack surface
