CheckView <= 2.3.1 - Unauthenticated REST API Authorization Bypass to Privilege Escalation
critical
The CheckView – Form & Checkout Testing plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 2.3.1. This makes it possible for unauthenticated attackers to bypass REST API authentication and leverage that to create an administrator account.
- CVSS:
- 9.8
(Wordfence)
- Affected:
- up to 2.3.1
- Fixed in:
- 2.3.2
- Disclosed:
- Aug 7, 2026
CVE-2026-18786 on NVD →
CheckView – Form & Checkout Testing <= 2.1.0 - Missing Authorization
medium
The CheckView – Form & Checkout Testing plugin for WordPress is vulnerable to unauthorized access due to a missing capability check on a function in versions up to, and including, 2.1.0. This makes it possible for unauthenticated attackers to perform an unauthorized action.
- CVSS:
- 5.3
(Wordfence)
- Affected:
- up to 2.1.0
- Fixed in:
- 2.2.0
- Disclosed:
- Jun 19, 2026
CVE-2026-54844 on NVD →
Protect your WordPress site
Run a free security scan to detect vulnerable plugins and themes, exposed files, and malware — no plugin install, no signup.
Scan your site free
← Back to the vulnerability database