# CVE-2026-121870: Simpler Checkout privilege escalation via empty auto-login key

Source: https://junglewise.ai/threats/cve-2026-121870-the-simpler-checkout-wordpress-plugin-before-1-5-4-does-not  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-11-11. Updated: 2026-11-11  
License: CC BY 4.0 with a link back

CVE-2026-121870 · Severity: info · Published 2026-11-11

The Simpler Checkout WordPress plugin before version 1.5.4 contains an authentication flaw that allows subscriber-level users to log in as administrators on stores that have not completed setup. An attacker with a subscriber account can exploit an unconfigured auto-login mechanism to gain administrative access, potentially compromising the entire store and customer data.

Vendors: [WP Engine](https://junglewise.ai/threats/vendors/wp-engine).

## Quick answers

**Is CVE-2026-121870 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-121870 being exploited in the wild.

**How severe is CVE-2026-121870?** Informational severity, published 11 November 2026.

**Which products and versions are affected?** WP Engine Simpler Checkout before 1.5.4.

**Is there a fix for CVE-2026-121870?** Yes: fixed in 1.5.4. Until then: Complete the Simpler Checkout plugin setup by configuring the auto-login key; restrict subscriber role creation to trusted users only until the plugin is fully configured. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-121870 attacked?** It is attacked over the network, in a web application.

**Am I affected by CVE-2026-121870?** Check whether you run WP Engine Simpler Checkout at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- Fixed in 1.5.4

Complete the Simpler Checkout plugin setup by configuring the auto-login key; restrict subscriber role creation to trusted users only until the plugin is fully configured.

## Technical details

The plugin fails to properly validate permissions when creating orders and uses an automatic login token that remains empty until the store owner completes initial configuration. Authenticated subscribers on incompletely configured stores can forge or bypass this token validation to escalate privileges to administrator. The vulnerability requires a subscriber account but no network access or user interaction beyond standard authentication.

## Affected products

- WP Engine Simpler Checkout before 1.5.4

## Timeline

- 2026-11-09: disclosed
- 2026-11-09: patched: version 1.5.4 released

## References

- [https://wpscan.com/vulnerability/a07c97a1-0faf-43fa-a4c7-0f09937790eb/](https://wpscan.com/vulnerability/a07c97a1-0faf-43fa-a4c7-0f09937790eb/)