CVE-2025-6688

Name of the Vulnerable Software and Affected Versions: Simple Payment plugin for WordPress versions 1.3.6 through 2.3.8

Description: The issue is related to Authentication Bypass, which occurs because the plugin does not properly verify a user's identity prior to logging them in through the create user() function. This allows unauthenticated attackers to log in as administrative users.

Recommendations: For versions 1.3.6 through 2.3.8, consider disabling the create user() function until a patch is available to prevent exploitation. Restrict access to administrative user accounts to minimize the risk of unauthorized access.