CVE-2026-1461
Awaiting Analysis Awaiting Analysis - Queue
Improper Validation in Simple Membership Plugin Enables Unauthorized Subscription Manipulation

Publication date: 2026-02-19

Last updated on: 2026-02-19

Assigner: Wordfence

Description
The Simple Membership plugin for WordPress is vulnerable to Improper Handling of Missing Values in all versions up to, and including, 4.7.0 via the Stripe webhook handler. This is due to the plugin only validating webhook signatures when the stripe-webhook-signing-secret setting is configured, which is empty by default. This makes it possible for unauthenticated attackers to forge Stripe webhook events to manipulate membership subscriptions, including reactivating expired memberships without payment or canceling legitimate subscriptions, potentially leading to unauthorized access and service disruption.
CVSS Scores
EPSS Scores
Probability:
Percentile:
Meta Information
Published
2026-02-19
Last Modified
2026-02-19
Generated
2026-05-07
AI Q&A
2026-02-19
EPSS Evaluated
2026-05-05
NVD
CVE-2026-1461
EUVD
EUVD-2026-7795
Affected Vendors & Products
Showing 1 associated CPE
Vendor Product Version / Range
simple_membership plugin to 4.7.0 (inc)
Helpful Resources
Exploitability
CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-230 The product does not handle or incorrectly handles when a parameter, field, or argument name is specified, but the associated value is missing, i.e. it is empty, blank, or null.
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?

The Simple Membership plugin for WordPress has a vulnerability in versions up to and including 4.7.0 related to improper handling of missing values in its Stripe webhook handler.

Specifically, the plugin only validates webhook signatures if the stripe-webhook-signing-secret setting is configured, but this setting is empty by default.

Because of this, unauthenticated attackers can forge Stripe webhook events, allowing them to manipulate membership subscriptions.

  • They can reactivate expired memberships without payment.
  • They can cancel legitimate subscriptions.

This can lead to unauthorized access and disruption of services.


How can this vulnerability impact me? :

This vulnerability can have several impacts on users of the Simple Membership plugin:

  • Unauthorized access to membership content by reactivating expired memberships without payment.
  • Disruption of legitimate services by canceling valid subscriptions.

Overall, it can lead to financial loss and service reliability issues.


How does this vulnerability affect compliance with common standards and regulations (like GDPR, HIPAA)?:

I don't know


How can this vulnerability be detected on my network or system? Can you suggest some commands?

I don't know


What immediate steps should I take to mitigate this vulnerability?

I don't know


Ask Our AI Assistant
Need more information? Ask your question to get an AI reply (Powered by our expertise)
0/70
EPSS Chart