Skip to content
fr Sign in
5.4 Medium

CVE-2026-88764 The Simple Membership WordPress plugin before 4.7.8 does not validate that the membership level supplied in a PayPal…

Description

The Simple Membership WordPress plugin before 4.7.8 does not validate that the membership level supplied in a PayPal payment notification matches the level configured for the paid payment button, allowing members to pay for a lower-priced membership while being granted a higher, more privileged membership level.

Affected products and versions

Product Affected versions Fixed in
Simple Membership 4.7 earliest → < 4.7.8 4.7.8

References

Timeline

  1. Published
  2. Last modified

Other CVEs of Simple Membership

The 12 CVEs of Simple Membership →
CVE-2026-88785 The Simple Membership WordPress plugin before 4.8.3 does not avoid transmitting a newly registered member's plaintext… 4.7 Medium CVE-2026-14936 The Simple Membership WordPress plugin before 4.7.7 does not verify that a PayPal payment notification was sent to the… 5.3 Medium CVE-2026-15931 The Simple Membership WordPress plugin before 4.7.8 does not sanitise a subscriber name value received from an… 6.1 Medium CVE-2026-15930 The Simple Membership WordPress plugin before 4.7.8 does not verify whether user creation failed during registration… 9.4 Critical
Track this CVE