EUVD-2026-37847
GHSA-6q57-f535-3g3g
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
Network-accessible webhook with no authentication (AV:N/PR:N); account deactivation causes both data integrity change (I:L) and user access loss (A:L); no confidentiality impact.
Primary rating from Vendor (Wordfence).
CVSS VectorVendor: Wordfence
Lifecycle Timeline
2DescriptionCVE.org
The Simple Membership plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 4.7.5. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for unauthenticated attackers to deactivate arbitrary member accounts by forging a charge.refunded webhook event containing a victim's subscription ID, setting the target member's account_state to 'inactive' and triggering cancellation hooks, transaction-record status changes, and cancellation notification emails. This vulnerability is exploitable only on installations where no Stripe webhook signing secret has been configured, which is the default out-of-the-box state; sites that have configured the stripe-webhook-signing-secret option are routed to the properly verified HMAC path and are not affected.
AnalysisAI
Authorization bypass in the Simple Membership WordPress plugin (≤4.7.5) enables unauthenticated remote attackers to forcibly deactivate any member account by submitting a forged Stripe charge.refunded webhook payload carrying a known victim subscription ID. The plugin's webhook handler skips HMAC signature verification when the stripe-webhook-signing-secret option is absent - the default installation state - accepting the forged event as legitimate and setting the target account_state to 'inactive', firing cancellation hooks, recording a transaction status change, and dispatching a cancellation notification email. No public exploit has been identified at time of analysis, and no KEV listing exists, but the zero-prerequisite network attack path against default-configured sites elevates practical risk above the 5.3 CVSS score suggests.
Technical ContextAI
The Simple Membership plugin (CPE: cpe:2.3:a:wpinsider-1:simple_membership:*:*:*:*:*:*:*:*) integrates Stripe subscription payments via a webhook handler in swpm-stripe-webhook-handler.php. Stripe's security model requires servers to validate incoming webhook requests using HMAC-SHA256 signatures computed with a per-account signing secret; without this check, any HTTP POST to the webhook endpoint can impersonate a legitimate Stripe event. The root cause is CWE-862 (Missing Authorization): the code paths at swpm-stripe-webhook-handler.php lines 71 and 297 process incoming charge.refunded events without verifying their origin when no signing secret is configured, passing control to account deactivation logic in swpm_handle_subsc_ipn.php line 381 and class.swpm-wp-loaded-tasks.php line 96. Sites that have configured the stripe-webhook-signing-secret option are routed to the properly verified HMAC path and are entirely unaffected, demonstrating that the fix mechanism already exists in the codebase - it is simply inactive by default.
RemediationAI
Update Simple Membership to version 4.7.6 or later - the upstream fix is confirmed committed at plugins.trac.wordpress.org changeset 3573852, though the exact patched release version is not independently confirmed from available references and should be verified against the WordPress plugin repository changelog. As an immediate compensating control applicable to any installed version, configure a Stripe webhook signing secret by setting the stripe-webhook-signing-secret option in the plugin settings; this routes all incoming webhook traffic through the HMAC-verified code path and fully mitigates the vulnerability without requiring an upgrade. This single configuration change is the most effective interim mitigation: once the secret is set, the unauthenticated code path is bypassed entirely with no functional side effects. Sites not using Stripe payment processing should audit whether the webhook endpoint is exposed and consider restricting access to it at the web server or firewall level. Full advisory details are at https://www.wordfence.com/threat-intel/vulnerabilities/id/2f91a7c3-ee0e-48e9-aa5f-dfc1160bbc09.
More in Simple Membership
View allThe Simple Membership WordPress plugin before 4.1.3 allows user to change their membership at the registration stage due
Account takeover of the primary WordPress administrator affects the Simple Membership plugin in all versions before 4.7.
Stored/reflected cross-site scripting in the Simple Membership WordPress plugin before 4.7.5 lets unauthenticated attack
The Simple Membership WordPress plugin before 4.1.3 does not properly validate the membership_level parameter when editi
The Simple Membership plugin before 3.8.5 for WordPress has CSRF affecting the Bulk Operation section. Rated high severi
The Simple Membership WordPress plugin before 4.1.0 does not have CSRF check in place when deleting Transactions, which
Stored cross-site scripting in the Simple Membership WordPress plugin before 4.7.8 allows unauthenticated attackers to i
The Simple Membership WordPress plugin before 4.1.1 does not properly sanitise and escape parameters before outputting t
Privilege escalation in the Simple Membership WordPress plugin before 4.7.8 allows authenticated members to obtain highe
The Simple Membership WordPress plugin before 4.0.9 does not have CSRF check when deleting members in bulk, which could
Remote attackers without any authentication can bypass authorization checks in the Simple Membership WordPress plugin (v
Broken access control in the WordPress Simple Membership plugin (versions ≤4.7.1) allows remote unauthenticated attacker
Same weakness CWE-862 – Missing Authorization
View allSame technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today