EUVD-2026-54193
GHSA-rx87-886c-g6fw
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
Network-reachable IPN endpoint requires no auth or interaction; impact is limited to low integrity (unauthorized membership grant) with no confidentiality or availability effect.
Primary rating from Vendor (wpscan).
CVSS VectorVendor: wpscan
Lifecycle Timeline
3DescriptionCVE.org
The Simple Membership WordPress plugin before 4.7.7 does not verify that a PayPal payment notification was sent to the site's own configured merchant account before activating a membership, allowing unauthenticated users to activate or extend a membership using a payment made to an arbitrary PayPal account they control.
AnalysisAI
Unauthorized membership activation in the Simple Membership WordPress plugin (before version 4.7.7) lets unauthenticated attackers obtain paid membership access at no cost by exploiting the absence of PayPal merchant account verification during payment notification processing. The CVSS vector (AV:N/AC:L/PR:N/UI:N) confirms low-complexity, unauthenticated network exploitation requiring no user interaction. No public exploit or active exploitation has been identified at time of analysis; a vendor-released patch (version 4.7.7) is available.
Technical ContextAI
Simple Membership integrates with PayPal's Instant Payment Notification (IPN) system, wherein PayPal sends HTTP POST callbacks to the plugin's endpoint upon transaction completion. A correct implementation must validate that the IPN receiver email matches the site's own configured merchant PayPal account before treating the notification as authoritative. This plugin omits that check, meaning any syntactically valid IPN - including one generated from a transaction made between two accounts entirely controlled by the attacker - is accepted and triggers membership activation. Although no CWE is formally assigned, this aligns with CWE-345 (Insufficient Verification of Data Authenticity) and CWE-290 (Authentication Bypass by Spoofing). The affected software range is confirmed by EUVD-2026-54193 as all Simple Membership versions from 0 up to (but not including) 4.7.7.
RemediationAI
Update the Simple Membership WordPress plugin to version 4.7.7 or later, which introduces verification that PayPal IPN notifications reference the site's own configured merchant account before activating or extending memberships. The patch is confirmed available per the WPScan advisory (https://wpscan.com/vulnerability/82ac8cd9-db44-49c7-905c-16d261c5c516/). Sites unable to update immediately should consider temporarily disabling PayPal-based membership activation and routing new membership sign-ups through an alternative payment method or manual approval workflow, accepting the trade-off of reduced payment automation. Reviewing existing memberships for suspicious activation timestamps (particularly any activated shortly before or after the disclosure date without corresponding legitimate payment records) is also advisable.
The mailSend function in the isMail transport in PHPMailer before 5.2.18 might allow remote attackers to pass extra para
The isMail transport in PHPMailer before 5.2.20 might allow remote attackers to pass extra parameters to the mail comman
The Backup Migration plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 1
The Hash Form - Drag & Drop Form Builder plugin for WordPress is vulnerable to arbitrary file uploads due to missing fil
Authentication bypass in the LiteSpeed Cache WordPress plugin (versions prior to 6.5.0.1) allows unauthenticated remote
The GiveWP - Donation Plugin and Fundraising Platform plugin for WordPress is vulnerable to PHP Object Injection in all
The Simple File List plugin for WordPress through version 4.2.2 contains an unauthenticated remote code execution vulner
The AI Engine WordPress plugin through version 3.1.3 exposes Bearer Token values through the /mcp/v1/ REST API endpoint
The SureTriggers WordPress plugin through version 1.0.82 contains a privilege escalation vulnerability that allows unaut
The Ninja Forms plugin before 2.9.42.1 for WordPress allows remote attackers to conduct PHP object injection attacks via
The Business Directory Plugin - Easy Listing Directories for WordPress plugin for WordPress is vulnerable to time-based
Remote code execution in WordPress 6.9.x (before 6.9.5) and 7.0.x (before 7.0.2) arises from a REST API batch endpoint r
Same technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today