Simple Payment, CVE-2025-6688

CVE, Research URL: CVE-2025-6688
Home page URL: Security reports for Simple Payment
Application: Simple Payment
Published on: Jun 27, 2025
Research Description: The Simple Payment plugin for WordPress is vulnerable to Authentication Bypass in versions 1.3.6 to 2.3.8. This is due to the plugin not properly verifying a user's identity prior to logging them in through the create_user() function. This makes it possible for unauthenticated attackers to log in as administrative users.
Affected versions: Min 1.3.6, max 2.3.9.
Status: vulnerable