Executive brief
Simple Membership is a popular WordPress plugin that manages paid membership subscriptions and access control. The plugin fails to validate PayPal payment notifications properly, allowing an attacker with a basic membership account to pay for a low-cost subscription while gaining access to a higher-tier, privileged membership level. This could result in unauthorized access to premium content, features, or administrative capabilities without paying the correct price.
Technical details
The vulnerability is an authentication/authorization bypass in PayPal payment processing where the plugin trusts the membership level encoded in the PayPal IPN (Instant Payment Notification) custom field without validating it matches the configured payment button. An attacker can intercept and modify the PayPal form's hidden `subsc_ref` field to change the membership level ID from a low-tier (e.g., Basic) to a high-tier (e.g., Premium) before payment, then complete checkout at the basic price. PayPal verifies the merchant and amount but echoes the attacker-modified custom field; the plugin then grants the elevated membership level. The attack requires an existing account at the lower membership tier and network access to modify the payment form. Fixed in version 4.7.8.
Affected products
- WordPress.org Simple Membership before 4.7.8
Timeline
- 2026-09-11: disclosed
- 2026-09-11: patched: Fixed in version 4.7.8
- 2026-09-13: advisory: CVE-2026-88764 published