CVE-2026-11855: Simple Membership WordPress Plugin Webhook Validation & XSS Vulnerability (High Severity)

Technical summary

CVE-2026-11855 involves two related security failures in Simple Membership's Stripe webhook handling: (1) absent webhook signature verification when a signing secret is not configured, and (2) insufficient output escaping of webhook data in administrator notices. The vulnerability chain allows unauthenticated attackers to craft malicious webhook payloads that bypass authentication controls and execute as reflected stored XSS in the WordPress admin dashboard. The CVSS 3.1 score of 8.8 (HIGH) reflects network accessibility, low attack complexity, no privilege requirement for the attack itself, but user interaction (admin viewing the notice) and impact across confidentiality, integrity, and availability.

Business impact

Sites using Simple Membership to process Stripe payments face risk of administrator account compromise, unauthorized plugin or theme installation, or site-wide defacement. An attacker can steal admin session cookies, modify site content, disable security controls, or exfiltrate customer payment data—particularly damaging given the plugin's integration with payment processing. The attack requires only that an administrator log in and view an admin notice, making it a high-likelihood exploitation scenario in active WordPress environments.

Affected systems

The Simple Membership WordPress plugin in versions prior to 4.7.5 is affected. The vulnerability is most severe for installations where Stripe webhook signing is not configured (a common misconfigurations scenario for smaller deployments or testing setups). Any WordPress site running the affected plugin version is vulnerable if an administrator user exists and may view admin notices.

Exploitability

This vulnerability is readily exploitable. It requires no authentication to craft and send a malicious webhook, no special network access, and no client-side exploit kit. The attacker only needs to understand basic HTTP POST requests and JavaScript payload crafting. The user interaction requirement—an administrator must view an admin notice—is a low bar in active WordPress environments where admins regularly check dashboard notifications. Public disclosure and straightforward attack mechanics suggest proof-of-concept code may emerge quickly.

Remediation

Update Simple Membership to version 4.7.5 or later immediately. Verify the update in the WordPress plugin dashboard and confirm the plugin version after patching. As an interim mitigation pending patching, disable Stripe webhook processing or ensure a webhook signing secret is configured (though this only addresses the authentication bypass, not the XSS). Additionally, review WordPress user roles and restrict administrator access to trusted personnel only.

Patch guidance

The vendor has released version 4.7.5 or later containing the fix. Access the WordPress admin dashboard, navigate to Plugins > Installed Plugins, locate Simple Membership, and click Update if available. After updating, verify the new version number is displayed. Sites using automatic plugin updates should be patched automatically; verify completion. No configuration changes are required post-update, but review webhook settings to ensure signing secrets are properly configured for defense-in-depth.

Detection guidance

Monitor server access logs and WordPress audit logs (via security plugins like Wordfence or Sucuri) for POST requests to webhook endpoints with suspicious or malformed parameters. Check admin notices in WordPress admin history and audit logs for unusual script content or encoding artifacts. Search the WordPress database for any notice or transient entries containing script tags or unusual JavaScript. Review administrator account login history for unexpected access around the time suspicious notices appear. Deploy Web Application Firewall (WAF) rules to block requests to webhook endpoints lacking proper signatures.

Why prioritize this

Despite not yet appearing on the CISA KEV catalog, this vulnerability merits immediate patching because it combines network accessibility, low attack complexity, and practical exploitability via a common WordPress admin pattern. The 8.8 CVSS score and XSS-to-RCE chain potential make this a high-priority risk in any environment running Simple Membership with active administrators. Early patching prevents opportunistic exploitation before mass scanning and weaponization occur.

Risk score, explained

The CVSS 3.1 score of 8.8 reflects: (1) network-based attack vector requiring no special access, (2) low complexity attack logic, (3) no privilege requirement to trigger the vulnerability, (4) user interaction (admin viewing notice) as a single gating factor, (5) impact across confidentiality (admin session hijacking), integrity (code injection and site modification), and availability (admin account lockout or site defacement). The HIGH severity is justified by the intersection of ease of exploitation and severity of impact on WordPress site security.

Frequently asked questions