EUVD-2025-19376Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Primary rating from NVD · only source for this CVE.
CVSS VectorNVD
Lifecycle Timeline
4DescriptionCVE.org
The Simple Payment plugin for WordPress is vulnerable to Authentication Bypass in versions 1.3.6 to 2.3.8. This is due to the plugin not properly verifying a user's identity prior to logging them in through the create_user() function. This makes it possible for unauthenticated attackers to log in as administrative users.
Analysis
The Simple Payment plugin for WordPress is vulnerable to Authentication Bypass in versions 1.3.6 to 2.3.8. This is due to the plugin not properly verifying a user's identity prior to logging them in through the create_user() function. This makes it possible for unauthenticated attackers to log in as administrative users.
Technical ContextAI
An authentication bypass vulnerability allows attackers to circumvent login mechanisms and gain unauthorized access without valid credentials.
RemediationAI
A vendor patch is available — apply it immediately. Implement robust authentication mechanisms. Use multi-factor authentication. Review authentication logic for bypass conditions. Remove default credentials.
More in Simple Payment
View allBroken access control in the Simple Payment WordPress plugin (versions 2.5.2 and below) allows unauthenticated remote at
Cross-site scripting in the Simple Payment WordPress plugin (versions ≤ 2.5.1) allows unauthenticated remote attackers t
Same technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today