What is the CVSS score of CVE-2026-14829?

CVE-2026-14829 has a CVSS 3.1 base score of 8.2 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:N. EPSS exploitation probability: 0.1%.

Which versions of Checkimate WordPress Plugin are affected by CVE-2026-14829?

Checkmate WooCommerce plugin through version 1.0.13 contains an authentication bypass enabling any remote attacker to permanently erase stored license keys and deactivate premium features from…

Is there a public PoC exploit available for CVE-2026-14829?

Yes, a public proof-of-concept exploit is available for CVE-2026-14829. Prioritise patching immediately. EPSS: 0.1%.

How to fix or mitigate CVE-2026-14829?

Within 24 hours, identify all WordPress installations running Checkmate plugin versions 1.0.13 and below, then immediately disable or remove the plugin to prevent unauthorized license erasure. Simultaneously, implement firewall or Web Application Firewall rules blocking access to the license-management endpoint if disabling the plugin is not immediately feasible. Within 7 days, either upgrade to a patched version once Checkmate releases a fix (monitor vendor advisories and WPScan daily), or migrate to an alternative checkout and abandoned-cart plugin that meets business requirements. Within 30 days, audit WordPress logs and license-key records to detect any unauthorized erasure events during the vulnerability window, document any premium-feature disruptions for incident reporting, and confirm the plugin has been either patched or permanently removed from all production instances.

Checkimate WordPress Plugin CVE-2026-14829

EUVD-2026-53729 HIGH

Improper Access Control (CWE-284)

2026-08-06 WPScan

GHSA-g882-hv44-rgqw

WordPress Authentication Bypass Checkimate Woocommerce Checkout Abandoned Cart Recovery Order Bumps Unknown

8.2

CVSS 3.1 · Vendor: WPScan

Severity by source

Vendor (WPScan) PRIMARY

8.2 HIGH

AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:N

vuln.today AI

7.5 HIGH

Network-accessible with no authentication; I:H for license key erasure; C:N because the attacker exploits public inputs rather than reading protected data.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (WPScan).

CVSS VectorVendor: WPScan

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

Low

Integrity

High

Availability

None

Lifecycle Timeline

Analysis Generated

Aug 06, 2026 - 16:20 vuln.today

CVE Published

Aug 06, 2026 - 06:00 cve.org

HIGH 8.2

CVE Published

Aug 06, 2026 - 06:00 cve.org

UNKNOWN (no severity yet)

DescriptionCVE.org

The Checkimate - WooCommerce Checkout, Abandoned Cart Recovery & Order Bumps WordPress plugin through 1.0.13 does not properly restrict access to its license-management functionality, relying on a shared secret computed entirely from publicly available information, allowing unauthenticated attackers to deactivate the Checkimate - WooCommerce Checkout, Abandoned Cart Recovery & Order Bumps WordPress plugin through 1.0.13's premium licensing state and erase the stored license key.

AnalysisAI

Unauthenticated license-key erasure and premium deactivation is possible in the Checkimate WooCommerce Checkout, Abandoned Cart Recovery & Order Bumps WordPress plugin through version 1.0.13. The plugin's license-management endpoint relies on a shared secret computed exclusively from publicly available site information - an authentication bypass that renders the access control trivially circumventable. Any remote attacker who can reach the WordPress site can permanently erase the stored license key and strip the installation of its paid premium status; a public proof-of-concept exists (reported by WPScan), though EPSS remains low at 0.14%, indicating opportunistic rather than widespread exploitation at time of analysis.

Technical ContextAI

The vulnerability is rooted in CWE-284 (Improper Access Control) applied to the plugin's license-management subsystem. Rather than issuing a cryptographically random, server-side secret for license verification, the Checkimate plugin derives its shared secret entirely from information observable to any external party. This design pattern - sometimes called 'security through obscurity' - collapses the authentication model: an attacker who can enumerate the public inputs can reconstruct the expected token without any privileged access. The affected component is a WooCommerce extension providing premium checkout flows, abandoned cart recovery workflows, and upsell order bumps. Per CPE data (cpe:2.3:a:unknown:checkimate_-_woocommerce_checkout...:*), all releases up to and including 1.0.13 carry this flaw. The WordPress plugin ecosystem's open-source nature means plugin request structures are easily reverse-engineered, further lowering exploitation complexity.

RemediationAI

No vendor-released patched version has been identified in available data at time of analysis; the WPScan advisory at https://wpscan.com/vulnerability/988d296f-9a85-4f6f-876e-c7379c9a3f3c/ should be monitored for an updated release. Until a fix is available, site operators should consider deactivating the Checkimate plugin entirely to prevent license-state manipulation - the trade-off is loss of all premium WooCommerce checkout and abandoned cart features during the interim. As a compensating control, network-layer rules (WAF or server firewall) can be used to restrict access to the specific plugin REST or admin-ajax endpoint responsible for license management to trusted IP ranges only, such as the site owner's IP; this limits the attack surface without disabling the plugin entirely. Operators should also immediately verify their current license state in the plugin settings panel to confirm it has not already been tampered with, and contact their license provider to re-issue the key if erasure is detected.