CVE-2026-12093
MediumCVSS 5.3Exploitation Probability (EPSS)
Low risk27th percentile — higher than 27% of all known CVEs
Summary
The Simple Membership plugin for WordPress is vulnerable to authorization bypass in all versions up to and including 4.7.5. This is due to the plugin not properly verifying that a user is authorized to perform an action, allowing unauthenticated attackers to deactivate member accounts.
Risk Assessment
Attackers can deactivate arbitrary member accounts, leading to loss of access to services and potential financial losses for the organization. The risk is particularly high in installations that have not configured the Stripe webhook signing secret.
Recommendation
It is recommended to configure the Stripe webhook signing secret to secure the installation against this vulnerability. Additionally, the plugin should be updated to the latest version to eliminate other potential vulnerabilities.
Original NVD description (English source)
The Simple Membership plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 4.7.5. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for unauthenticated attackers to deactivate arbitrary member accounts by forging a charge.refunded webhook event containing a victim's subscription ID, setting the target member's account_state to 'inactive' and triggering cancellation hooks, transaction-record status changes, and cancellation notification emails. This vulnerability is exploitable only on installations where no Stripe webhook signing secret has been configured, which is the default out-of-the-box state; sites that have configured the stripe-webhook-signing-secret option are routed to the properly verified HMAC path and are not affected.