6.5
Medium
CVE-2026-1461 The Simple Membership plugin for WordPress is vulnerable to Improper Handling of Missing Values in all versions up to,…
Description
The Simple Membership plugin for WordPress is vulnerable to Improper Handling of Missing Values in all versions up to, and including, 4.7.0 via the Stripe webhook handler. This is due to the plugin only validating webhook signatures when the stripe-webhook-signing-secret setting is configured, which is empty by default. This makes it possible for unauthenticated attackers to forge Stripe webhook events to manipulate membership subscriptions, including reactivating expired memberships without payment or canceling legitimate subscriptions, potentially leading to unauthorized access and service disruption.
Affected products and versions
| Product | Affected versions | Fixed in |
|---|---|---|
| Simple Membership 4.7 | earliest → 4.7.0 | No fix stated |
Other CVEs of Simple Membership
The 11 CVEs of Simple Membership →
CVE-2026-103427
The Simple Membership plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'country' parameter in…
6.4
Medium
CVE-2026-97337
The Simple Membership plugin for WordPress is vulnerable to unauthorized modification of data and sensitive…
7.5
High
CVE-2026-77194
The Simple Membership plugin for WordPress is vulnerable to Authentication Bypass leading to Administrator Account…
5.3
Medium
CVE-2026-12093
The Simple Membership plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including,…
5.3
Medium