PT-2026-20777 · WordPress+1 · Simple Membership+1

Rafał · Published 2026-02-19 · Updated 2026-02-19 · CVE-2026-1461

Positive Technologies (AI Summary)

CVSS v3.1

6.5

Medium

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions Simple Membership plugin for WordPress versions prior to 4.7.1

Description The Simple Membership plugin for WordPress is susceptible to an issue involving improper handling of missing values in the Stripe webhook handler. The plugin only validates webhook signatures when the stripe-webhook-signing-secret setting is configured, which is empty by default. This allows unauthenticated attackers to forge Stripe webhook events. Successful exploitation can lead to manipulation of membership subscriptions, including reactivating expired memberships without payment or canceling legitimate subscriptions, potentially resulting in unauthorized access and service disruption.

Recommendations Update the Simple Membership plugin to version 4.7.1 or later.

Fix

Weakness Enumeration

CWE-230

Related Identifiers

CVE-2026-1461

Affected Products

Simple Membership

Stripe

References · 7

• https://nvd.nist.gov/vuln/detail/CVE-2026-1461 · Security Note
• https://plugins.trac.wordpress.org/browser/simple-membership/trunk/ipn/swpm-stripe-webhook-handler.php#L26 · Note
• https://t.me/CVEtracker/45105 · Telegram Post
• https://wordfence.com/threat-intel/vulnerabilities/id/4e4df9a6-8f7d-428b-a596-0751ca047169?source=cve · Note
• https://twitter.com/CVEnew/status/2024501232187167000 · Twitter Post
• https://plugins.trac.wordpress.org/browser/simple-membership/trunk/classes/class.swpm-wp-loaded-tasks.php#L90 · Note
• https://plugins.trac.wordpress.org/changeset/3453404 · Note