CVE-2026-14936

Received Received - Intake

Unauthenticated Membership Activation via PayPal in Simple Membership WordPress Plugin

Publication date: 2026-08-06

Last updated on: 2026-08-06

Assigner: WPScan

Description

The Simple Membership WordPress plugin before 4.7.7 does not verify that a PayPal payment notification was sent to the site's own configured merchant account before activating a membership, allowing unauthenticated users to activate or extend a membership using a payment made to an arbitrary PayPal account they control.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-08-06

Last Modified

2026-08-06

Generated

2026-08-07

AI Q&A

2026-08-07

EPSS Evaluated

N/A

NVD

CVE-2026-14936

Affected Vendors & Products

Vendor	Product	Version / Range
simple_membership	simple_membership	to 4.7.7 (exc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-UNKNOWN

Attack-Flow Graph

Executive Summary

This vulnerability affects the Simple Membership WordPress plugin before version 4.7.7. It allows unauthenticated users to activate or extend a membership by exploiting a flaw where the plugin does not verify if a PayPal payment notification was sent to the site's configured merchant account. Instead, it accepts payments made to any PayPal account controlled by the attacker.

Impact Analysis

An attacker could exploit this to grant unauthorized access to premium membership features without paying the correct merchant. This could lead to financial loss, unauthorized content access, or abuse of membership privileges. The impact is limited to membership activation but does not directly expose sensitive data.

Compliance Impact

This vulnerability does not directly impact GDPR or HIPAA compliance since it does not involve unauthorized data access or exposure. However, if unauthorized users gain membership access, it could lead to violations of access control policies, potentially affecting compliance with standards requiring strict user role management.

Mitigation Strategies

Update the Simple Membership WordPress plugin to version 4.7.7 or later to address the vulnerability.

Hi! I’m here to help you understand CVE-2026-14936. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70