Simple Membership <=4.7.5 Missing Authorization Unauthenticated Member Account Deactivation via Webhook

Vulnerability Overview Vulnerability Name: Simple Membership <= 4.7.5 - Missing Authorization to Unauthenticated Arbitrary Member Account Deactivation via Forged Stripe 'charge.refunded' Webhook CVE ID: CVE-2026-12093 CVSS Score: 5.3 (Medium) Publication Date: June 17, 2026 Last Updated: June 18, 2026 Researcher: Nikita Fienko - self Impact Scope Affected Versions: Simple Membership <= 4.7.5 Vulnerability Description: Simple Membership plugins version 4.7.5 and earlier contain an authorization bypass vulnerability. This vulnerability allows unauthenticated attackers to set the status of a target member account to "inactive" by forging Stripe's 'charge.refunded' webhook event, triggering cancellation hooks, transaction record status changes, and cancellation notification emails. This vulnerability is only exploitable on sites that have not configured the Stripe webhook signature key; default out-of-the-box sites are not affected. Remediation Fixed Version: Upgrade to version 4.7.6 or higher Patch Status: Fixed References plugins.trac.wordpress.org Additional Information Software Type: Plugin Software Slug: simple-membership Patch Status: Fixed Remediation Advice: Upgrade to version 4.7.6 or higher Recent Vulnerabilities Simple Membership <= 4.7.1 - Missing Authorization - CVE ID: CVE-2026-34886 - CVSS Score: 5.3 - Researcher: Jakub Herman - Date: March 31, 2026 Simple Membership <= 4.7.0 - Unauthenticated Improper Handling of Missing Values - CVE ID: CVE-2026-1461 - CVSS Score: 6.5 - Researcher: 0N0ise - Date: February 18, 2026 Simple Membership <= 4.6.9 - Missing Authorization - CVE ID: CVE-2026-25308 - CVSS Score: 4.3 - Researcher: andrea bocchetti - Date: January 19, 2026 Simple Membership <= 4.6.3 - Authenticated (Administrator+) Stored Cross-Site Scripting via Shortcode - CVE ID: CVE-2025-49333 - CVSS Score: 4.4 - Researcher: bittable - Date: June 5, 2025 Simple Membership <= 4.5.5 - Exposure of Private Personal Information to an Unauthorized Actor - CVE ID: CVE-2024-11088 - CVSS Score: 5.3 - Researcher: Francesco Carlucci - Date: November 20, 2024 Simple Membership <= 4.5.3 - Unauthenticated Open Redirect - CVE ID: CVE-2024-49482 - CVSS Score: 6.1 - Researcher: ardias - Date: October 21, 2024 Simple Membership <= 4.4.5 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode - CVE ID: CVE-2024-4383 - CVSS Score: 6.4 - Researcher: wesley (wcraft) - Date: May 3, 2024 Simple Membership <= 4.4.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode - CVE ID: CVE-2024-3730 - CVSS Score: 5.4 - Researcher: Thanh Nam Tran - Date: April 24, 2024 Simple Membership <= 4.4.2 - Unauthenticated Stored Self-Based Cross-Site Scripting - CVE ID: CVE-2024-1985 - CVSS Score: 4.7 - Researcher: stealthcopier - Date: March 5, 2024 Simple Membership <= 4.4.1 - Open Redirect - CVE ID: CVE-2024-22308 - CVSS Score: 6.1 - Researcher: Joshua Chan - Date: January 19, 2024 Summary Simple Membership plugins version 4.7.5 and earlier contain an authorization bypass vulnerability, allowing unauthenticated attackers to set the status of a target member account to "inactive" by forging Stripe's 'charge.refunded' webhook event. It is recommended to upgrade to version 4.7.6 or higher to remediate this vulnerability.

Goal Reached Thanks to every supporter — we hit 100%!

Simple Membership <=4.7.5 Missing Authorization Unauthenticated Member Account Deactivation via Webhook

More from this source