{“lastseen”:””,”description”:”The Simple Membership plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 4.7.5. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for unauthenticated attackers to deactivate arbitrary member accounts by forging a charge.refunded webhook event containing a victim’s subscription ID, setting the target member’s account_state to ‘inactive’ and triggering cancellation hooks, transaction-record status changes, and cancellation notification emails. This vulnerability is exploitable only on installations where no Stripe webhook signing secret has been configured, which is the default out-of-the-box state; sites that have configured the stripe-webhook-signing-secret option are routed to the properly verified HMAC path and are not affected.”,”published”:”2026-06-18T05:34:25.315Z”,”modified”:”2026-06-18T13:53:39.765Z”,”type”:”cve”,”title”:”Simple Membership \\u003c= 4.7.5 – Missing Authorization to Unauthenticated Arbitrary Member Account Deactivation via Forged Stripe ‘charge.refunded’ Webhook”,”source”:”Wordfence”,”references”:”https:\/\/www.wordfence.com\/threat-intel\/vulnerabilities\/id\/2f91a7c3-ee0e-48e9-aa5f-dfc1160bbc09?source=cve\\nhttps:\/\/plugins.trac.wordpress.org\/browser\/simple-membership\/tags\/4.7.4\/ipn\/swpm-stripe-webhook-handler.php#L297\\nhttps:\/\/plugins.trac.wordpress.org\/browser\/simple-membership\/tags\/4.7.4\/ipn\/swpm-stripe-webhook-handler.php#L71\\nhttps:\/\/plugins.trac.wordpress.org\/browser\/simple-membership\/tags\/4.7.4\/classes\/class.swpm-wp-loaded-tasks.php#L96\\nhttps:\/\/plugins.trac.wordpress.org\/browser\/simple-membership\/tags\/4.7.4\/ipn\/swpm_handle_subsc_ipn.php#L381\\nhttps:\/\/plugins.trac.wordpress.org\/browser\/simple-membership\/tags\/4.7.3\/ipn\/swpm-stripe-webhook-handler.php#L297\\nhttps:\/\/plugins.trac.wordpress.org\/browser\/simple-membership\/tags\/4.7.3\/ipn\/swpm-stripe-webhook-handler.php#L71\\nhttps:\/\/plugins.trac.wordpress.org\/browser\/simple-membership\/tags\/4.7.3\/classes\/class.swpm-wp-loaded-tasks.php#L96\\nhttps:\/\/plugins.trac.wordpress.org\/browser\/simple-membership\/tags\/4.7.3\/ipn\/swpm_handle_subsc_ipn.php#L381\\nhttps:\/\/plugins.trac.wordpress.org\/changeset?sfp_email=\\u0026sfph_mail=\\u0026reponame=\\u0026old=3573852%40simple-membership\\u0026new=3573852%40simple-membership\\u0026sfp_email=\\u0026sfph_mail=”,”id”:”CVE-2026-12093″,”bulletinFamily”:””,”cwe”:[“CWE-862″],”cvelist”:null,”sourceData”:”wpinsider-1 Simple Membership 0″,”sourceHref”:””,”cvss”:{“score”:5.3,”severity”:”MEDIUM”,”vector”:”CVSS:3.1\/AV:N\/AC:L\/PR:N\/UI:N\/S:U\/C:N\/I:L\/A:N”,”version”:”3.1″},”cvss2″:{},”cvss3″:{“version”:””,”vectorString”:””,”baseScore”:0,”baseSeverity”:””,”attackVector”:””,”attackComplexity”:””,”privilegesRequired”:””,”userInteraction”:””,”scope”:””,”confidentialityImpact”:””,”integrityImpact”:””,”availabilityImpact”:””,”cvssV3″:{“version”:””,”vectorString”:””,”baseScore”:0,”baseSeverity”:””,”attackVector”:””,”attackComplexity”:””,”privilegesRequired”:””,”userInteraction”:””,”scope”:””,”confidentialityImpact”:””,”integrityImpact”:””,”availabilityImpact”:””}},”href”:””,”category_name”:”CVE”,”post_link”:””,”product”:”Simple Membership”,”version”:”0″,”vendor”:”wpinsider-1″,”ai_description”:””,”ai_severity”:””,”ai_vendor”:””,”ai_product”:””,”ai_version”:””,”ai_score”:0}<\/p>\n","protected":false},"excerpt":{"rendered":"
{“lastseen”:””,”description”:”The Simple Membership plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 4.7.5. This is due to the plugin…<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[2],"tags":[6,8,22,12,21,13,7,11,5],"class_list":["post-64221","post","type-post","status-publish","format-standard","hentry","category-category_cve","tag-cve","tag-cvss","tag-cvss-53","tag-exploit","tag-medium","tag-news","tag-security","tag-tapic","tag-vulnerability"],"yoast_head":"\n