Simple Membership
Monthly
Remote attackers without any authentication can bypass authorization checks in the Simple Membership WordPress plugin (versions ≤ 4.7.8), enabling unauthorized write operations against membership-protected resources. The CVSS vector (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N) confirms exploitation requires no credentials, no user interaction, and low complexity, making this trivially scriptable at scale against any WordPress site running the affected plugin. No public exploit code or CISA KEV listing has been identified at time of analysis, though the Patchstack disclosure provides sufficient detail for independent exploit development.
Account takeover of the primary WordPress administrator affects the Simple Membership plugin in all versions before 4.7.8. Because the registration routine never checks whether user creation actually succeeded before treating the returned value as a valid user ID, an unauthenticated attacker can trigger a failed user creation and cause the plugin to overwrite the existing admin account's data - notably the email address - then seize the account through the standard password-reset flow. A vendor patch (4.7.8) and publicly available exploit details from WPScan exist, though EPSS remains low at 0.14% (4th percentile), indicating no measured mass exploitation yet.
Stored/reflected cross-site scripting in the Simple Membership WordPress plugin before 4.7.5 lets unauthenticated attackers execute arbitrary JavaScript in a logged-in administrator's browser by abusing the Stripe webhook handler. When no Stripe signing secret is configured, the plugin fails to verify webhook authenticity and then renders an attacker-controlled value unescaped inside an admin notice. Publicly available exploit code exists (WPScan), though EPSS remains low at 0.18% and no active exploitation is reported (not in CISA KEV).
Broken access control in the WordPress Simple Membership plugin (versions ≤4.7.1) allows remote unauthenticated attackers to modify protected resources due to missing authorization checks. The flaw, reported by Patchstack and tracked as EUVD-2026-36917, carries a CVSS 3.1 score of 7.5 reflecting high integrity impact with no confidentiality or availability effect. No public exploit identified at time of analysis, but the network-reachable, no-auth profile makes WordPress sites running this plugin a realistic target.
Privilege escalation in the Simple Membership WordPress plugin before 4.7.8 allows authenticated members to obtain higher-tier memberships without paying the correct price. The plugin's PayPal IPN (Instant Payment Notification) handler accepts the membership level asserted in the payment notification without verifying it matches the level configured for the specific payment button that was purchased, enabling a low-cost membership purchase to be fraudulently upgraded to any higher tier. A publicly available exploit exists, and vendor patch 4.7.8 resolves the issue.
Administrator account takeover in the Simple Membership plugin for WordPress (versions up to and including 4.8.0) is achievable by unauthenticated remote attackers targeting WordPress Multisite networks with public registration enabled. The plugin's registration flow binds new membership records to existing global WordPress users using only username and email matching - no password or ownership proof - and fails to detect Administrator roles on child sites, allowing attackers to subsequently overwrite the victim's global WordPress password via the profile-edit feature. No public exploit has been identified at time of analysis, but the attack mechanics are low-complexity and the CVSS score of 5.3 severely understates the actual Administrator-level impact.
Stored cross-site scripting in the Simple Membership WordPress plugin before 4.7.8 allows unauthenticated attackers to inject arbitrary JavaScript into the WordPress administration dashboard by supplying a malicious subscriber name in a payment approval request. Because the plugin neither sanitizes the input at ingestion nor escapes it on output when rendered for administrators, the payload persists server-side and executes in any administrator's browser session upon viewing the affected dashboard panel. A public proof-of-concept exploit exists (reported by WPScan); however, EPSS stands at 0.17% (7th percentile) and CISA KEV listing is absent, indicating limited observed mass exploitation at time of analysis.
Authorization bypass in the Simple Membership WordPress plugin (≤4.7.5) enables unauthenticated remote attackers to forcibly deactivate any member account by submitting a forged Stripe charge.refunded webhook payload carrying a known victim subscription ID. The plugin's webhook handler skips HMAC signature verification when the stripe-webhook-signing-secret option is absent - the default installation state - accepting the forged event as legitimate and setting the target account_state to 'inactive', firing cancellation hooks, recording a transaction status change, and dispatching a cancellation notification email. No public exploit has been identified at time of analysis, and no KEV listing exists, but the zero-prerequisite network attack path against default-configured sites elevates practical risk above the 5.3 CVSS score suggests.
Cross-site scripting in the Simple Membership WordPress plugin (versions up to and including 4.7.2) allows injection of malicious scripts that execute in the context of other users' browsers. The official CVSS vector assigns PR:L (low privileges required), which directly contradicts the CVE description's claim of 'unauthenticated' exploitation - this discrepancy must be resolved with the vendor before accurate risk tiering. With a scope-changed impact (S:C), the primary concern is an attacker inducing a privileged user such as a WordPress administrator to trigger the payload, enabling session hijacking or unauthorized administrative actions. No public exploit code or active exploitation in CISA KEV has been identified at time of analysis.
The Simple Membership plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 4.5.5 via the WordPress core search feature. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. This Exposure of Sensitive Information vulnerability could allow attackers to access sensitive data that should not be disclosed.
URL Redirection to Untrusted Site ('Open Redirect') vulnerability in wp.insider Simple Membership simple-membership allows Phishing.5.3. Rated medium severity (CVSS 4.7), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
The Simple Membership plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'swpm_paypal_subscription_cancel_link' shortcode in all versions up to, and including, 4.4.5. Rated medium severity (CVSS 6.4), this vulnerability is remotely exploitable, low attack complexity. This Cross-Site Scripting (XSS) vulnerability could allow attackers to inject malicious scripts into web pages viewed by other users.
The Simple Membership plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'swpm_paypal_subscription_cancel_link' shortcode in all versions up to, and including, 4.4.3. Rated medium severity (CVSS 5.4), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
The Simple Membership plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'Display Name' parameter in all versions up to, and including, 4.4.2 due to insufficient input. Rated medium severity (CVSS 4.7), this vulnerability is remotely exploitable, no authentication required. This Cross-Site Scripting (XSS) vulnerability could allow attackers to inject malicious scripts into web pages viewed by other users.
URL Redirection to Untrusted Site ('Open Redirect') vulnerability in smp7, wp.Insider Simple Membership.4.1. Rated low severity (CVSS 3.4), this vulnerability is remotely exploitable, no authentication required. No vendor patch available.
The Simple Membership plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the ‘environment_mode’ parameter in all versions up to, and including, 4.3.8 due to insufficient input. Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. This Cross-Site Scripting (XSS) vulnerability could allow attackers to inject malicious scripts into web pages viewed by other users.
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in smp7, wp.Insider Simple Membership allows Reflected XSS.3.8. Rated high severity (CVSS 7.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
The Simple Membership plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the `list_type` parameter in versions up to, and including, 4.3.5 due to insufficient input sanitization. Rated high severity (CVSS 7.2), this vulnerability is remotely exploitable, no authentication required, low attack complexity. This Cross-Site Scripting (XSS) vulnerability could allow attackers to inject malicious scripts into web pages viewed by other users.
The Simple Membership WordPress plugin before 4.1.3 allows user to change their membership at the registration stage due to insufficient checking of a user supplied parameter. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
The Simple Membership WordPress plugin before 4.1.3 does not properly validate the membership_level parameter when editing a profile, allowing members to escalate to a higher membership level by. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
The Simple Membership WordPress plugin before 4.1.1 does not properly sanitise and escape parameters before outputting them back in AJAX actions, leading to Reflected Cross-Site Scripting. Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
The Simple Membership WordPress plugin before 4.1.0 does not have CSRF check in place when deleting Transactions, which could allow attackers to make a logged in admin delete arbitrary transactions. Rated medium severity (CVSS 6.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
The Simple Membership WordPress plugin before 4.0.9 does not have CSRF check when deleting members in bulk, which could allow attackers to make a logged in admin delete them via a CSRF attack. Rated medium severity (CVSS 4.7), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
The Simple Membership plugin before 3.8.5 for WordPress has CSRF affecting the Bulk Operation section. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
Remote attackers without any authentication can bypass authorization checks in the Simple Membership WordPress plugin (versions ≤ 4.7.8), enabling unauthorized write operations against membership-protected resources. The CVSS vector (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N) confirms exploitation requires no credentials, no user interaction, and low complexity, making this trivially scriptable at scale against any WordPress site running the affected plugin. No public exploit code or CISA KEV listing has been identified at time of analysis, though the Patchstack disclosure provides sufficient detail for independent exploit development.
Account takeover of the primary WordPress administrator affects the Simple Membership plugin in all versions before 4.7.8. Because the registration routine never checks whether user creation actually succeeded before treating the returned value as a valid user ID, an unauthenticated attacker can trigger a failed user creation and cause the plugin to overwrite the existing admin account's data - notably the email address - then seize the account through the standard password-reset flow. A vendor patch (4.7.8) and publicly available exploit details from WPScan exist, though EPSS remains low at 0.14% (4th percentile), indicating no measured mass exploitation yet.
Stored/reflected cross-site scripting in the Simple Membership WordPress plugin before 4.7.5 lets unauthenticated attackers execute arbitrary JavaScript in a logged-in administrator's browser by abusing the Stripe webhook handler. When no Stripe signing secret is configured, the plugin fails to verify webhook authenticity and then renders an attacker-controlled value unescaped inside an admin notice. Publicly available exploit code exists (WPScan), though EPSS remains low at 0.18% and no active exploitation is reported (not in CISA KEV).
Broken access control in the WordPress Simple Membership plugin (versions ≤4.7.1) allows remote unauthenticated attackers to modify protected resources due to missing authorization checks. The flaw, reported by Patchstack and tracked as EUVD-2026-36917, carries a CVSS 3.1 score of 7.5 reflecting high integrity impact with no confidentiality or availability effect. No public exploit identified at time of analysis, but the network-reachable, no-auth profile makes WordPress sites running this plugin a realistic target.
Privilege escalation in the Simple Membership WordPress plugin before 4.7.8 allows authenticated members to obtain higher-tier memberships without paying the correct price. The plugin's PayPal IPN (Instant Payment Notification) handler accepts the membership level asserted in the payment notification without verifying it matches the level configured for the specific payment button that was purchased, enabling a low-cost membership purchase to be fraudulently upgraded to any higher tier. A publicly available exploit exists, and vendor patch 4.7.8 resolves the issue.
Administrator account takeover in the Simple Membership plugin for WordPress (versions up to and including 4.8.0) is achievable by unauthenticated remote attackers targeting WordPress Multisite networks with public registration enabled. The plugin's registration flow binds new membership records to existing global WordPress users using only username and email matching - no password or ownership proof - and fails to detect Administrator roles on child sites, allowing attackers to subsequently overwrite the victim's global WordPress password via the profile-edit feature. No public exploit has been identified at time of analysis, but the attack mechanics are low-complexity and the CVSS score of 5.3 severely understates the actual Administrator-level impact.
Stored cross-site scripting in the Simple Membership WordPress plugin before 4.7.8 allows unauthenticated attackers to inject arbitrary JavaScript into the WordPress administration dashboard by supplying a malicious subscriber name in a payment approval request. Because the plugin neither sanitizes the input at ingestion nor escapes it on output when rendered for administrators, the payload persists server-side and executes in any administrator's browser session upon viewing the affected dashboard panel. A public proof-of-concept exploit exists (reported by WPScan); however, EPSS stands at 0.17% (7th percentile) and CISA KEV listing is absent, indicating limited observed mass exploitation at time of analysis.
Authorization bypass in the Simple Membership WordPress plugin (≤4.7.5) enables unauthenticated remote attackers to forcibly deactivate any member account by submitting a forged Stripe charge.refunded webhook payload carrying a known victim subscription ID. The plugin's webhook handler skips HMAC signature verification when the stripe-webhook-signing-secret option is absent - the default installation state - accepting the forged event as legitimate and setting the target account_state to 'inactive', firing cancellation hooks, recording a transaction status change, and dispatching a cancellation notification email. No public exploit has been identified at time of analysis, and no KEV listing exists, but the zero-prerequisite network attack path against default-configured sites elevates practical risk above the 5.3 CVSS score suggests.
Cross-site scripting in the Simple Membership WordPress plugin (versions up to and including 4.7.2) allows injection of malicious scripts that execute in the context of other users' browsers. The official CVSS vector assigns PR:L (low privileges required), which directly contradicts the CVE description's claim of 'unauthenticated' exploitation - this discrepancy must be resolved with the vendor before accurate risk tiering. With a scope-changed impact (S:C), the primary concern is an attacker inducing a privileged user such as a WordPress administrator to trigger the payload, enabling session hijacking or unauthorized administrative actions. No public exploit code or active exploitation in CISA KEV has been identified at time of analysis.
The Simple Membership plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 4.5.5 via the WordPress core search feature. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. This Exposure of Sensitive Information vulnerability could allow attackers to access sensitive data that should not be disclosed.
URL Redirection to Untrusted Site ('Open Redirect') vulnerability in wp.insider Simple Membership simple-membership allows Phishing.5.3. Rated medium severity (CVSS 4.7), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
The Simple Membership plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'swpm_paypal_subscription_cancel_link' shortcode in all versions up to, and including, 4.4.5. Rated medium severity (CVSS 6.4), this vulnerability is remotely exploitable, low attack complexity. This Cross-Site Scripting (XSS) vulnerability could allow attackers to inject malicious scripts into web pages viewed by other users.
The Simple Membership plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'swpm_paypal_subscription_cancel_link' shortcode in all versions up to, and including, 4.4.3. Rated medium severity (CVSS 5.4), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
The Simple Membership plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'Display Name' parameter in all versions up to, and including, 4.4.2 due to insufficient input. Rated medium severity (CVSS 4.7), this vulnerability is remotely exploitable, no authentication required. This Cross-Site Scripting (XSS) vulnerability could allow attackers to inject malicious scripts into web pages viewed by other users.
URL Redirection to Untrusted Site ('Open Redirect') vulnerability in smp7, wp.Insider Simple Membership.4.1. Rated low severity (CVSS 3.4), this vulnerability is remotely exploitable, no authentication required. No vendor patch available.
The Simple Membership plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the ‘environment_mode’ parameter in all versions up to, and including, 4.3.8 due to insufficient input. Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. This Cross-Site Scripting (XSS) vulnerability could allow attackers to inject malicious scripts into web pages viewed by other users.
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in smp7, wp.Insider Simple Membership allows Reflected XSS.3.8. Rated high severity (CVSS 7.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
The Simple Membership plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the `list_type` parameter in versions up to, and including, 4.3.5 due to insufficient input sanitization. Rated high severity (CVSS 7.2), this vulnerability is remotely exploitable, no authentication required, low attack complexity. This Cross-Site Scripting (XSS) vulnerability could allow attackers to inject malicious scripts into web pages viewed by other users.
The Simple Membership WordPress plugin before 4.1.3 allows user to change their membership at the registration stage due to insufficient checking of a user supplied parameter. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
The Simple Membership WordPress plugin before 4.1.3 does not properly validate the membership_level parameter when editing a profile, allowing members to escalate to a higher membership level by. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
The Simple Membership WordPress plugin before 4.1.1 does not properly sanitise and escape parameters before outputting them back in AJAX actions, leading to Reflected Cross-Site Scripting. Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
The Simple Membership WordPress plugin before 4.1.0 does not have CSRF check in place when deleting Transactions, which could allow attackers to make a logged in admin delete arbitrary transactions. Rated medium severity (CVSS 6.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
The Simple Membership WordPress plugin before 4.0.9 does not have CSRF check when deleting members in bulk, which could allow attackers to make a logged in admin delete them via a CSRF attack. Rated medium severity (CVSS 4.7), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
The Simple Membership plugin before 3.8.5 for WordPress has CSRF affecting the Bulk Operation section. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.