Unauthorized Stripe Payment Method Attachment in Membership Plugin

Executive Summary

This vulnerability is an Insecure Direct Object Reference (IDOR) flaw in the Kadence Memberships WordPress plugin. It allows subscriber-level members to access and manipulate another member's Stripe payment details without proper authorization. Specifically, the plugin fails to verify if the membership referenced in a payment request belongs to the user making the request.

Useful 0 Not Useful 0

Detection Guidance

Check if your WordPress site uses the Membership Plugin versions 3.2.17 to 4.0.5. Inspect payment requests for unauthorized access to Stripe client secrets or payment method attachments. Review server logs for suspicious activity related to membership or payment handling.

Useful 0 Not Useful 0

Impact Analysis

If you are a subscriber-level member using this plugin, an attacker could exploit this flaw to view another member's Stripe payment client secret. They could also attach their own payment method to another member's pending payment, potentially leading to unauthorized transactions or financial loss.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability could lead to violations of GDPR and HIPAA due to unauthorized access to sensitive payment information. GDPR requires protection of personal data, while HIPAA mandates safeguarding protected health information. A breach could result in legal penalties and reputational damage.

Useful 0 Not Useful 0

Mitigation Strategies

Update the Membership Plugin to version 4.0.6 or later immediately. Disable subscriber-level access to payment-related functions until the update is applied. Monitor for unauthorized payment method attachments or data disclosures.

Useful 0 Not Useful 0