Simple Membership <= 4.7.0 - Unauthenticated Improper Handling of Missing Values
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- None
- Attack complexity
- Low
- Impact type
- —
- Confidentiality · integrity · availability
- Low · Low · None
- Fix status
- No fix listed
Attack profile from CVSS 3.1 · CNA. Fix status from CNA.
Summary
The Simple Membership plugin for WordPress is vulnerable to Improper Handling of Missing Values in all versions up to, and including, 4.7.0 via the Stripe webhook handler. This is due to the plugin only validating webhook signatures when the stripe-webhook-signing-secret setting is configured, which is empty by default. This makes it possible for unauthenticated attackers to forge Stripe webhook events to manipulate membership subscriptions, including reactivating expired memberships without payment or canceling legitimate subscriptions, potentially leading to unauthorized access and service disruption.
Why it matters now
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- Yes
- Technical impact
- Partial
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| wpinsider-1 | Simple Membership | up to 4.7.0 | — | No fix listed | CNA |
- Simple Membership Vendorwpinsider-1 Affected up to 4.7.0 Fixed in — No fix listed CNA
CPE names Threatist (inferred) · 1
Inferred from how NVD named this product before; not given by a source.
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:simple-membership-plugin:simple_membership:*:*:*:*:*:*:*:* | — | — | wpinsider-1 |
- cpe:2.3:a:simple-membership-plugin:simple_membership:*:*:*:*:*:*:*:* Versions — — ·wpinsider-1
Remediation
No fixed version listed by the sources yet.
Timeline
- 2026-10-02 Threatist record created from CVE-2026-1461
- 2026-10-03 Alias added: GHSA-h972-rpm4-hj8q
References
Other 4
- https://www.wordfence.com/threat-intel/vulnerabilities/id/4e4df9a6-8f7d-428b-a596-0751ca047169?source=cve
- https://plugins.trac.wordpress.org/browser/simple-membership/trunk/ipn/swpm-stripe-webhook-handler.php#L26
- https://plugins.trac.wordpress.org/browser/simple-membership/trunk/classes/class.swpm-wp-loaded-tasks.php#L90
- https://plugins.trac.wordpress.org/changeset/3453404/
More wpinsider-1 vulnerabilities
- TI-2022-04084 Simple Membership < 4.2.2 - Contributor+ Stored XSS CVSS 3.1MEDIUM 5.4
- TI-2023-22342 WordPress Simple Membership plugin <= 4.3.4 - Unauthenticated Membership Role Privilege Escalation vulnerability CVSS 3.1CRITICAL 9.8
- TI-2022-02140 Simple Membership < 4.1.3 - Unauthenticated Membership Privilege Escalation CVSS 3.1CRITICAL 9.8
- TI-2019-10675 The Simple Membership plugin before 3.8.5 for WordPress has CSRF affecting the Bulk Operation section. CVSS 3.0HIGH 8.8
- TI-2023-22341 WordPress Simple Membership plugin <= 4.3.4 - Authenticated Account Takeover vulnerability CVSS 3.1HIGH 8.8
- TI-2024-10273 Simple Membership <= 4.5.5 - Exposure of Private Personal Information to an Unauthorized Actor CVSS 3.1HIGH 7.5
Sources
- CVE-2026-1461 · CVE Program
- CVE-2026-1461 · NVD
- FIRST EPSS
- GHSA-h972-rpm4-hj8q · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences