CVE-2025-7642CRITICAL 9.8EPSS p36.5%

CVE-2025-7642CVE-2025-7642

Description

The Simpler Checkout plugin for WordPress is vulnerable to Authentication Bypass in versions 0.7.0 to 1.1.9. This is due to the plugin not properly verifying a user's identity prior to logging them in as an admin through the simplerwc_woocommerce_order_created() function. This makes it possible for unauthenticated attackers to log in as other users based on their order ID, which can be an administrator if a site admin has placed a test order.

Scoring

CVSS 3.19.8 (CRITICAL)
VectorCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
EPSS0.46% probability of exploitation · percentile 36.5% · 2026-06-19T12:03:05Z
Published2025-08-23
Last modified2026-04-15

Underlying weaknesses· 1

CWE-288

References

  1. https://plugins.trac.wordpress.org/browser/simpler-checkout/tags/1.1.9/includes/hooks.php#L7
  2. https://www.wordfence.com/threat-intel/vulnerabilities/id/02cf0e1a-bd12-44b1-9bc5-1a5ec332b000?source=cve

1

TypeTargetConfidenceTier
WeaknessAuthentication Bypass Using an Alternate Path or Channelcwe-2880%live

Related by meaning· 6

Nearest entities by semantic similarity across the cs-graph corpus.

CVE
CVE-2025-6688
CVE
CVE-2025-10484
CVE
CVE-2025-11457
CVE
CVE-2025-2266
CVE
CVE-2025-3852
CVE
CVE-2025-12095
Sourced from NVD + FIRST.org EPSS. Curated for EU compliance use cases by Adam Lundqvist, Founder at SQUR.