6.5
Moyenne
CVE-2026-1461 The Simple Membership plugin for WordPress is vulnerable to Improper Handling of Missing Values in all versions up to,…
Description
The Simple Membership plugin for WordPress is vulnerable to Improper Handling of Missing Values in all versions up to, and including, 4.7.0 via the Stripe webhook handler. This is due to the plugin only validating webhook signatures when the stripe-webhook-signing-secret setting is configured, which is empty by default. This makes it possible for unauthenticated attackers to forge Stripe webhook events to manipulate membership subscriptions, including reactivating expired memberships without payment or canceling legitimate subscriptions, potentially leading to unauthorized access and service disruption.
Produits et versions touchés
| Produit | Versions touchées | Corrigé en |
|---|---|---|
| Simple Membership 4.7 | premières → 4.7.0 | Pas de correctif indiqué |
Autres CVE de Simple Membership
Les 11 CVE de Simple Membership →
CVE-2026-103427
The Simple Membership plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'country' parameter in…
6.4
Moyenne
CVE-2026-97337
The Simple Membership plugin for WordPress is vulnerable to unauthorized modification of data and sensitive…
7.5
Élevée
CVE-2026-77194
The Simple Membership plugin for WordPress is vulnerable to Authentication Bypass leading to Administrator Account…
5.3
Moyenne
CVE-2026-12093
The Simple Membership plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including,…
5.3
Moyenne