Simple Membership CVE-2026-12093

Exploitation requires that the Simple Membership plugin's stripe-webhook-signing-secret option is NOT configured - this is the explicit default out-of-the-box installation state, meaning no deliberate misconfiguration is required on the operator's part. Attackers must supply a valid subscription ID for the target member within the forged webhook payload; this subscription ID must be known or enumerable, which partially limits fully automated bulk exploitation. The CVSS vector (AV:N/AC:L/PR:N/UI:N) confirms no authentication, no user interaction, and no special network positioning are required. Exploitation is completely blocked on sites that have configured the stripe-webhook-signing-secret option, as those deployments are routed exclusively to the HMAC-verified handler; this is the single definitive limiting factor.

The CVSS 3.1 score of 5.3 (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N) captures the zero-credential, network-accessible nature of the attack but its I:L rating understates the business impact: bulk account deactivations across a paying membership site constitute a targeted denial-of-access attack that, while not crashing the underlying system, directly disrupts service for legitimate subscribers. The critical real-world risk factor is deployment prevalence: because the vulnerable configuration is the default out-of-the-box state, a large fraction of Simple Membership installations are expected to be vulnerable without any explicit misconfiguration on the operator's part. No EPSS score was provided in the source data; no KEV listing exists; no public exploit code has been identified at time of analysis. The requirement to know or enumerate a target subscription ID provides a partial natural barrier against fully automated mass exploitation, though subscription IDs may be exposed through various application or social-engineering vectors. The availability of a code-level fix in changeset 3573852 of the plugin repository is confirmed, but the specific patched release version is not independently confirmed from available references.

An attacker targeting a membership-based WordPress site identifies that Simple Membership ≤4.7.5 is installed and confirms via default-configuration indicators that no Stripe webhook signing secret is set. The attacker obtains a target subscriber's Stripe subscription ID - through a prior data exposure, social engineering, or application-level enumeration - then crafts and submits an HTTP POST to the site's Stripe webhook endpoint with a forged charge.refunded JSON payload referencing that subscription ID. The plugin accepts the unauthenticated request, deactivates the member account, and sends the victim a cancellation email, all without the attacker possessing any credentials or requiring any interaction from the victim or site administrator. No public exploit code has been identified at time of analysis.