EUVD-2026-76956
GHSA-cmhf-4mfx-3gf7
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessRegister low-tier membership account
-
DeliveryInitiate PayPal checkout for cheap tier
-
ExploitCraft or intercept PayPal IPN POST
-
ExecutionSubstitute higher membership level ID in payload
-
PersistSubmit forged IPN to WordPress endpoint
-
ImpactPlugin grants unauthorized premium membership
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A06:2025 - Insecure Design
ASVS 5.0
V8 - Authorization Least privilege enforcement
MITRE ATT&CK
1 technique across 1 tactic: Privilege Escalation The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires: (1) an existing authenticated WordPress member account on the targeted site - a free or lowest-tier registration is sufficient; (2) the target site must have the Simple Membership plugin installed in a version before 4.7.8 with PayPal payment integration actively configured; (3) the attacker must be able to submit a crafted HTTP POST request to the site's PayPal IPN endpoint, either by intercepting the legitimate IPN flow or by directly posting a forged IPN payload. Exploitation is limited by the need for an initial member account and the requirement that PayPal IPN is used for membership fulfillment - sites using only manual membership approval or alternative payment gateways are not affected by this specific vector. |
| Impact | The CVSS 3.1 score of 5.4 (AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N) accurately reflects the network-accessible, low-complexity, low-privilege nature of this business-logic flaw. The PR:L metric confirms exploitation requires an existing authenticated member account - an attacker must first register and purchase any membership tier before escalating. The impact is bounded to unauthorized access to higher-tier content and financial loss for the site operator, with no confidentiality or availability risk beyond content access. A public exploit exists per WPScan reporting, raising practical exploitability, though no CISA KEV listing indicates mass exploitation has not been confirmed. Even a mid-sized municipal IT team in leszno running a community membership site on WordPress should treat this as urgent if using Simple Membership, since public exploit code makes it trivially actionable for any existing member. EPSS data was not provided but the combination of public exploit, low complexity, and broad WordPress deployment warrants prompt patching. |
| Exploit ScenarioDerived | An authenticated member holding a low-tier membership initiates a PayPal checkout for a discounted plan, then intercepts or crafts a spoofed IPN callback to the WordPress site's IPN handler, substituting the membership level identifier with one corresponding to a premium tier. The plugin, lacking server-side validation of this field against the payment button's configured level, grants the higher membership tier upon processing the notification. A publicly available exploit exists, meaning this attack path is well-documented and requires minimal technical skill beyond basic HTTP request manipulation. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Sep 13, 2026
Privilege escalation in the Simple Membership WordPress plugin before 4.7.8 allows authenticated members to obtain higher-tier memberships without paying the correct price. The plugin's PayPal IPN (Instant Payment Notification) handler accepts the membership level asserted in the payment notification without verifying it matches the level configured for the specific payment button that was purchased, enabling a low-cost membership purchase to be fraudulently upgraded to any higher tier. A publicly available exploit exists, and vendor patch 4.7.8 resolves the issue.
RemediationAI
Update the Simple Membership WordPress plugin to version 4.7.8 or later, which validates that the membership level in the PayPal IPN payload matches the level configured for the originating payment button. The fix is confirmed available from the vendor. As an interim workaround if immediate update is not possible, site administrators can disable PayPal IPN-based membership assignment and switch to manual membership approval - this prevents automated privilege escalation but introduces operational overhead for membership activation. Administrators should also audit existing member accounts for unexpected membership tier elevations that may have occurred prior to patching. The WPScan advisory at https://wpscan.com/vulnerability/54fdf46e-0385-40a3-b3bc-a862dc0fb03e/ provides additional context.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
Simple Membership is a WordPress plugin providing gated content behind paid membership tiers integrated with PayPal via its Instant Payment Notification (IPN) system. When PayPal sends a POST callback to the site confirming a payment, the plugin is expected to map the payment to a specific membership level configured for that payment button. The root cause is CWE-269 (Improper Privilege Management): the plugin trusts the membership level identifier supplied within the IPN payload rather than cross-referencing it with the server-side configuration for the button that initiated the transaction. The affected CPE range is cpe:2.3:a:unknown:simple_membership:*:*:*:*:*:*:*:*, covering all releases before 4.7.8.
Know when Simple Membership gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N
Network-reachable IPN endpoint; low privilege (existing member account required); no UI interaction; limited to content access and integrity (membership tier fraud), no availability impact.
Primary rating from Vendor (WPScan).
CVSS VectorVendor: WPScan
Lifecycle Timeline
4DescriptionCVE.org
The Simple Membership WordPress plugin before 4.7.8 does not validate that the membership level supplied in a PayPal payment notification matches the level configured for the paid payment button, allowing members to pay for a lower-priced membership while being granted a higher, more privileged membership level.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Privilege escalation occurs when an attacker leverages flaws in access control mechanisms to gain permissions beyond what they were originally granted.
More in Simple Membership
View allThe Simple Membership WordPress plugin before 4.1.3 allows user to change their membership at the registration stage due
Account takeover of the primary WordPress administrator affects the Simple Membership plugin in all versions before 4.7.
Stored/reflected cross-site scripting in the Simple Membership WordPress plugin before 4.7.5 lets unauthenticated attack
The Simple Membership WordPress plugin before 4.1.3 does not properly validate the membership_level parameter when editi
The Simple Membership plugin before 3.8.5 for WordPress has CSRF affecting the Bulk Operation section. Rated high severi
The Simple Membership WordPress plugin before 4.1.0 does not have CSRF check in place when deleting Transactions, which
Stored cross-site scripting in the Simple Membership WordPress plugin before 4.7.8 allows unauthenticated attackers to i
The Simple Membership WordPress plugin before 4.1.1 does not properly sanitise and escape parameters before outputting t
Simple Membership, a WordPress membership plugin, transmits a newly registered member's plaintext password in a URL quer
The Simple Membership WordPress plugin before 4.0.9 does not have CSRF check when deleting members in bulk, which could
Unauthenticated attackers can redirect activation and registration-complete emails to an arbitrary address in Simple Mem
Broken access control in the WordPress Simple Membership plugin (versions ≤4.7.1) allows remote unauthenticated attacker
Exploit-DB