EUVD-2026-37847
GHSA-6q57-f535-3g3g
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
Network-accessible webhook with no authentication (AV:N/PR:N); account deactivation causes both data integrity change (I:L) and user access loss (A:L); no confidentiality impact.
Primary rating from Vendor (Wordfence).
CVSS VectorVendor: Wordfence
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
Lifecycle Timeline
2DescriptionCVE.org
The Simple Membership plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 4.7.5. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for unauthenticated attackers to deactivate arbitrary member accounts by forging a charge.refunded webhook event containing a victim's subscription ID, setting the target member's account_state to 'inactive' and triggering cancellation hooks, transaction-record status changes, and cancellation notification emails. This vulnerability is exploitable only on installations where no Stripe webhook signing secret has been configured, which is the default out-of-the-box state; sites that have configured the stripe-webhook-signing-secret option are routed to the properly verified HMAC path and are not affected.
AnalysisAI
Authorization bypass in the Simple Membership WordPress plugin (≤4.7.5) enables unauthenticated remote attackers to forcibly deactivate any member account by submitting a forged Stripe charge.refunded webhook payload carrying a known victim subscription ID. The plugin's webhook handler skips HMAC signature verification when the stripe-webhook-signing-secret option is absent - the default installation state - accepting the forged event as legitimate and setting the target account_state to 'inactive', firing cancellation hooks, recording a transaction status change, and dispatching a cancellation notification email. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires that the Simple Membership plugin's stripe-webhook-signing-secret option is NOT configured - this is the explicit default out-of-the-box installation state, meaning no deliberate misconfiguration is required on the operator's part. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 3.1 score of 5.3 (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N) captures the zero-credential, network-accessible nature of the attack but its I:L rating understates the business impact: bulk account deactivations across a paying membership site constitute a targeted denial-of-access attack that, while not crashing the underlying system, directly disrupts service for legitimate subscribers. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | An attacker targeting a membership-based WordPress site identifies that Simple Membership ≤4.7.5 is installed and confirms via default-configuration indicators that no Stripe webhook signing secret is set. The attacker obtains a target subscriber's Stripe subscription ID - through a prior data exposure, social engineering, or application-level enumeration - then crafts and submits an HTTP POST to the site's Stripe webhook endpoint with a forged charge.refunded JSON payload referencing that subscription ID. … |
| Remediation | Update Simple Membership to version 4.7.6 or later - the upstream fix is confirmed committed at plugins.trac.wordpress.org changeset 3573852, though the exact patched release version is not independently confirmed from available references and should be verified against the WordPress plugin repository changelog. … Detailed patch versions, workarounds, and compensating controls in full report. |
Threat intelligence, references, and detailed analysis are available after sign-in.
More in Simple Membership
View allThe Simple Membership WordPress plugin before 4.1.3 allows user to change their membership at the registration stage due
The Simple Membership WordPress plugin before 4.7.5 does not verify the authenticity of Stripe webhook requests when no
The Simple Membership WordPress plugin before 4.1.3 does not properly validate the membership_level parameter when editi
The Simple Membership plugin before 3.8.5 for WordPress has CSRF affecting the Bulk Operation section. Rated high severi
The Simple Membership WordPress plugin before 4.1.0 does not have CSRF check in place when deleting Transactions, which
The Simple Membership WordPress plugin before 4.1.1 does not properly sanitise and escape parameters before outputting t
The Simple Membership WordPress plugin before 4.0.9 does not have CSRF check when deleting members in bulk, which could
Broken access control in the WordPress Simple Membership plugin (versions ≤4.7.1) allows remote unauthenticated attacker
The Simple Membership plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and in
The Simple Membership plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the `list_type` parameter
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in smp7, wp.Insider S
Cross-site scripting in the Simple Membership WordPress plugin (versions up to and including 4.7.2) allows injection of
Same weakness CWE-862 – Missing Authorization
View allSame technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today