PT-2026-20777 · WordPress+1 · Simple Membership+1

Rafał · Publicado 2026-02-19 · Atualizado 2026-02-19 · CVE-2026-1461

Positive Technologies (AI Summary)

CVSS v3.1

6.5

Média

Vetor base

AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions Simple Membership plugin for WordPress versions prior to 4.7.1

Description The Simple Membership plugin for WordPress is susceptible to an issue involving improper handling of missing values in the Stripe webhook handler. The plugin only validates webhook signatures when the stripe-webhook-signing-secret setting is configured, which is empty by default. This allows unauthenticated attackers to forge Stripe webhook events. Successful exploitation can lead to manipulation of membership subscriptions, including reactivating expired memberships without payment or canceling legitimate subscriptions, potentially resulting in unauthorized access and service disruption.

Recommendations Update the Simple Membership plugin to version 4.7.1 or later.

Correção

Enumeração de Fraquezas

CWE-230

Identificadores relacionados

CVE-2026-1461

Produtos afetados

Simple Membership

Stripe

Referências · 7

• https://plugins.trac.wordpress.org/browser/simple-membership/trunk/ipn/swpm-stripe-webhook-handler.php#L26 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2026-1461 · Nota de Segurança
• https://t.me/CVEtracker/45105 · Publicação no Telegram
• https://wordfence.com/threat-intel/vulnerabilities/id/4e4df9a6-8f7d-428b-a596-0751ca047169?source=cve · Nota
• https://twitter.com/CVEnew/status/2024501232187167000 · Publicação no Twitter
• https://plugins.trac.wordpress.org/browser/simple-membership/trunk/classes/class.swpm-wp-loaded-tasks.php#L90 · Nota
• https://plugins.trac.wordpress.org/changeset/3453404 · Nota