Checkimate Woocommerce Checkout Abandoned Cart Recovery Order Bumps
Monthly
Unauthenticated license-key erasure and premium deactivation is possible in the Checkimate WooCommerce Checkout, Abandoned Cart Recovery & Order Bumps WordPress plugin through version 1.0.13. The plugin's license-management endpoint relies on a shared secret computed exclusively from publicly available site information - an authentication bypass that renders the access control trivially circumventable. Any remote attacker who can reach the WordPress site can permanently erase the stored license key and strip the installation of its paid premium status; a public proof-of-concept exists (reported by WPScan), though EPSS remains low at 0.14%, indicating opportunistic rather than widespread exploitation at time of analysis.
Unauthenticated license-key erasure and premium deactivation is possible in the Checkimate WooCommerce Checkout, Abandoned Cart Recovery & Order Bumps WordPress plugin through version 1.0.13. The plugin's license-management endpoint relies on a shared secret computed exclusively from publicly available site information - an authentication bypass that renders the access control trivially circumventable. Any remote attacker who can reach the WordPress site can permanently erase the stored license key and strip the installation of its paid premium status; a public proof-of-concept exists (reported by WPScan), though EPSS remains low at 0.14%, indicating opportunistic rather than widespread exploitation at time of analysis.