Executive Summary
The Checkimate — WooCommerce Checkout, Abandoned Cart Recovery & Order Bumps WordPress plugin through 1.0.13 is vulnerable to an unauthenticated license deactivation attack. This vulnerability, tracked as CVE-2026-14829, allows attackers to deactivate the plugin's premium features and erase the license key. The vulnerability has a CVSS score of 8.2, indicating high severity.
Technical Analysis
The vulnerability class of CVE-2026-14829 is improper access control. The plugin does not properly restrict access to its license-management functionality, relying on a shared secret computed entirely from publicly available information. This allows unauthenticated attackers to manipulate the plugin's licensing state.
How It Gets Exploited
An unauthenticated remote attacker can exploit this vulnerability by accessing the plugin's license-management functionality. The attacker would send a request to the vulnerable plugin's license management endpoint, using the publicly available information to compute the shared secret. Upon successful exploitation, the attacker can deactivate the plugin's premium licensing state and erase the stored license key.
Impact Assessment
The Checkimate — WooCommerce Checkout, Abandoned Cart Recovery & Order Bumps WordPress plugin through 1.0.13 is affected. An attacker can achieve high integrity impact, allowing them to deactivate the plugin and erase the license key. The confidentiality impact is low, and there is no availability impact. The CVSS score is 8.2, indicating high severity.
Recommended Actions
To mitigate this vulnerability, users should update the Checkimate — WooCommerce Checkout, Abandoned Cart Recovery & Order Bumps WordPress plugin to a version later than 1.0.13. Additionally, users should monitor their plugin's license management functionality for any suspicious activity.
Sources
- National Vulnerability Database (NVD)
- WPScan