CVE-2025-6688 Simple Payment 1.3.6 - 2.3.8 - Authentication Bypass to Admin
Unauthenticated attackers can bypass authentication to log in as administrators due to improper identity verification in the Simple Payment plugin.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2025-6688?
CVE-2025-6688 is a critical authentication bypass vulnerability in idokd Simple Payment, published on 27 Jun 2025. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
The Simple Payment plugin for WordPress is vulnerable to Authentication Bypass in versions 1.3.6 to 2.3.8. This is due to the plugin not properly verifying a user's identity prior to logging them in through the create_user() function. This makes it possible for unauthenticated attackers to log in as administrative users.
Weakness: CWE-288
Which versions are affected by CVE-2025-6688?
It affects 1 product.
Products include Idokd Simple Payment.
How do I fix CVE-2025-6688?
No fix has been published for CVE-2025-6688 yet. Limit exposure of the affected software until one is available.
Upgrade, and rotate credentials and sessions that may have been exposed. More about Authentication bypass.
Is CVE-2025-6688 being exploited?
There is no known exploitation of CVE-2025-6688 in the wild and no public exploit code.
Sources
Also known as GHSA-x3mp-x433-h32f.