CVE-2025-6688
BaseFortify
Publication date: 2025-06-27
Last updated on: 2025-07-02
Assigner: Wordfence
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| idokd | simple_payment | From 1.3.6 (inc) to 2.3.9 (exc) |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-288 | The product requires authentication, but the product has an alternate path or channel that does not require authentication. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
The vulnerability in the Simple Payment WordPress plugin (versions 1.3.6 to 2.3.8) is an Authentication Bypass. It occurs because the plugin does not properly verify a user's identity before logging them in through the create_user() function. This flaw allows unauthenticated attackers to log in as administrative users without proper credentials.
How can this vulnerability impact me? :
This vulnerability can have severe impacts as it allows unauthenticated attackers to gain administrative access to a WordPress site using the Simple Payment plugin. With administrative privileges, attackers can control the site, modify content, access sensitive data, install malicious code, or disrupt site operations. The CVSS score of 9.8 indicates a critical severity with high impact on confidentiality, integrity, and availability.
How can this vulnerability be detected on my network or system? Can you suggest some commands?
The provided resources do not include specific detection methods or commands to identify exploitation of this vulnerability on your network or system. Detection would typically involve monitoring for unauthorized administrative logins or unusual authentication activity related to the Simple Payment plugin, but no explicit commands or tools are described.
What immediate steps should I take to mitigate this vulnerability?
To mitigate this vulnerability, you should immediately update the Simple Payment WordPress plugin to version 2.3.9 or later, as this version includes security fixes addressing the authentication bypass issue. Additionally, ensure your WordPress environment meets the plugin requirements such as PHP 7.4 or higher, and review plugin settings related to transaction verification and safe redirects to enhance security. [1]