Skip to content
Sign in
5.3 Medium

CVE-2026-14936 The Simple Membership WordPress plugin before 4.7.7 does not verify that a PayPal payment notification was sent to the…

Description

The Simple Membership WordPress plugin before 4.7.7 does not verify that a PayPal payment notification was sent to the site's own configured merchant account before activating a membership, allowing unauthenticated users to activate or extend a membership using a payment made to an arbitrary PayPal account they control.

Affected products and versions

Product Affected versions Fixed in
Simple Membership 4.7 earliest → < 4.7.7 4.7.7

Other CVEs of Simple Membership

The 12 CVEs of Simple Membership →
CVE-2026-88785 The Simple Membership WordPress plugin before 4.8.3 does not avoid transmitting a newly registered member's plaintext… 4.7 Medium CVE-2026-88764 The Simple Membership WordPress plugin before 4.7.8 does not validate that the membership level supplied in a PayPal… 5.4 Medium CVE-2026-15931 The Simple Membership WordPress plugin before 4.7.8 does not sanitise a subscriber name value received from an… 6.1 Medium CVE-2026-15930 The Simple Membership WordPress plugin before 4.7.8 does not verify whether user creation failed during registration… 9.4 Critical
Track this CVE