5.3
Moyenne
CVE-2026-14936 The Simple Membership WordPress plugin before 4.7.7 does not verify that a PayPal payment notification was sent to the…
Description
The Simple Membership WordPress plugin before 4.7.7 does not verify that a PayPal payment notification was sent to the site's own configured merchant account before activating a membership, allowing unauthenticated users to activate or extend a membership using a payment made to an arbitrary PayPal account they control.
Produits et versions touchés
| Produit | Versions touchées | Corrigé en |
|---|---|---|
| Simple Membership 4.7 | premières → < 4.7.7 | 4.7.7 |
Références
- wpscan.com wpscan.com
Chronologie
- Publiée
- Dernière modification
Autres CVE de Simple Membership
Les 12 CVE de Simple Membership →
CVE-2026-88785
The Simple Membership WordPress plugin before 4.8.3 does not avoid transmitting a newly registered member's plaintext…
4.7
Moyenne
CVE-2026-88764
The Simple Membership WordPress plugin before 4.7.8 does not validate that the membership level supplied in a PayPal…
5.4
Moyenne
CVE-2026-15931
The Simple Membership WordPress plugin before 4.7.8 does not sanitise a subscriber name value received from an…
6.1
Moyenne
CVE-2026-15930
The Simple Membership WordPress plugin before 4.7.8 does not verify whether user creation failed during registration…
9.4
Critique