Authorization Bypass in Simple Membership Plugin for WordPress

CVE-2026-12093

What is CVE-2026-12093?

The Simple Membership plugin for WordPress is susceptible to an authorization bypass flaw across all versions prior to and including 4.7.5. This vulnerability arises because the plugin inadequately ensures that a user has the necessary permissions to perform certain actions. Unauthenticated attackers can exploit this flaw to deactivate any member's account by replicating a charge.refunded webhook event that contains the victim's subscription ID. Consequently, this triggers the setting of the member's account state to 'inactive,' leading to executed cancellation hooks, changes to transaction record statuses, and the sending of cancellation notification emails. This vulnerability is primarily exploitable in installations that do not have the Stripe webhook signing secret configured, which is the default state for new installations; those that have configured the signing secret are directed to the HMAC verification process and remain unaffected.

References