WordPress CVEs

Description

The Simple Membership plugin for WordPress is vulnerable to Improper Handling of Missing Values in all versions up to, and including, 4.7.0 via the Stripe webhook handler. This is due to the plugin only validating webhook signatures when the stripe-webhook-signing-secret setting is configured, which is empty by default. This makes it possible for unauthenticated attackers to forge Stripe webhook events to manipulate membership subscriptions, including reactivating expired memberships without payment or canceling legitimate subscriptions, potentially leading to unauthorized access and service disruption.

Affected WordPress components

• Simple Membership Plugin · simple-membership
  Confirmed match Active
  Up to and including 4.7.0
  View on WordPress.org

A confirmed match is backed by the plugin or theme slug. A possible match is based on the product name only and should be verified.

Affected products and versions

• wpinsider-1 Simple Membership — Up to and including 4.7.0

References

• plugins.trac.wordpress.org https://plugins.trac.wordpress.org/browser/simple-membership/trunk/classes/class.swpm-wp-loaded-tasks.php#L90
• plugins.trac.wordpress.org https://plugins.trac.wordpress.org/browser/simple-membership/trunk/ipn/swpm-stripe-webhook-handler.php#L26
• plugins.trac.wordpress.org https://plugins.trac.wordpress.org/changeset/3453404/
• www.wordfence.com https://www.wordfence.com/threat-intel/vulnerabilities/id/4e4df9a6-8f7d-428b-a596-0751ca047169?source=cve
• nvd.nist.gov Official NVD record