Threats tagged 'ghsa-hh27-gq4q-7xq8'

The Simpler Checkout WordPress plugin versions before 1.5.4 have a vulnerability where the plugin does not properly restrict order creation permissions and uses an automatic login link with a key that remains empty until the store owner completes plugin setup. This flaw allows subscriber-level users on stores that have not completed setup to log in as administrators.