CVE-2026-12093: Simple Membership WordPress Plugin Authorization Bypass Allows Account Deactivation

Technical summary

CVE-2026-12093 is an authorization bypass vulnerability in the Simple Membership plugin (≤4.7.5) stemming from inadequate webhook signature verification. The plugin processes charge.refunded events from Stripe but, in its default configuration, does not validate HMAC signatures using the stripe-webhook-signing-secret. An unauthenticated attacker can POST a forged webhook event specifying a victim's subscription ID, which the plugin accepts and acts upon by setting account_state to 'inactive', triggering cancellation hooks, transaction-record updates, and notification emails. The vulnerability is classified under CWE-862 (Missing Authorization).

Business impact

Compromised site operators face loss of membership revenue and customer trust when legitimate member accounts are arbitrarily suspended. Bulk exploitation could disrupt the customer base of e-commerce or subscription-based WordPress sites. While the impact is limited to integrity (account state modification) with no confidentiality loss, the operational disruption and customer service burden are non-trivial. Affected organizations may experience increased support tickets, disputed chargebacks, and reputational damage if members discover their accounts were maliciously deactivated.

Affected systems

Simple Membership plugin for WordPress, all versions up to and including 4.7.5. Only installations without a configured Stripe webhook signing secret are vulnerable; this is the default configuration. Sites that have explicitly set the stripe-webhook-signing-secret option in their WordPress configuration are not affected because they use the secure HMAC verification path.

Exploitability

Exploitability is straightforward: an attacker needs only to craft and send a POST request to the plugin's webhook handler with a forged charge.refunded event payload containing a valid subscription ID from the target site. No authentication, user interaction, or advanced technical knowledge is required. The network-accessible webhook endpoint accepts requests from any source by default. However, exploitation is limited to the subset of sites running vulnerable versions without webhook signature verification configured.

Remediation

Upgrade Simple Membership to the patched version that properly enforces HMAC signature verification on all incoming Stripe webhooks. As an immediate mitigation, administrators can manually configure the stripe-webhook-signing-secret option with the correct signing secret from their Stripe account settings, which routes webhook processing through the verified HMAC validation code path and prevents forged events from being accepted.

Patch guidance

Update Simple Membership to the latest version available from WordPress.org plugin repository or the vendor's official channel. Verify the update includes restored or enhanced webhook signature validation logic. After patching, test the Stripe integration to ensure webhooks are still processed correctly. If upgrading is delayed, apply the temporary mitigation by configuring stripe-webhook-signing-secret in wp-config.php or via your WordPress configuration manager, then verify the setting takes effect by checking that the HMAC verification path is invoked in the plugin logs.

Detection guidance

Monitor web server access logs for POST requests to the Simple Membership webhook endpoint (typically /wp-content/plugins/simple-membership/webhook.php or similar) from unexpected IP addresses or at unusual times. Check WordPress database transaction logs for sudden account_state changes to 'inactive' for multiple members within a short window, especially if no corresponding legitimate charge.refunded events appear in your Stripe dashboard. Enable WordPress debug logging and audit membership plugin logs for webhook processing errors or unsigned event acceptance. Correlate any member account deactivations with Stripe webhook event timestamps to identify spoofed events.

Why prioritize this

Although CVSS 5.3 (MEDIUM) reflects limited scope and no confidentiality impact, this vulnerability warrants prompt attention because: (1) it requires no authentication and zero user interaction, (2) it directly targets revenue-generating membership systems, (3) the default configuration of most installations leaves them vulnerable, and (4) exploitation is trivial to automate at scale. Organizations relying on Simple Membership for subscription revenue should prioritize remediation alongside their critical-severity issues.

Risk score, explained

The CVSS 5.3 MEDIUM score reflects a network-accessible, unauthenticated attack (AV:N/AC:L/PR:N) with no user interaction (UI:N) that impacts integrity only (I:L), without confidentiality or availability loss. While account deactivation is a meaningful business impact, the absence of data exfiltration or service unavailability keeps the severity moderate. The score appropriately reflects that this is a targeted, authorization-based issue rather than a critical system compromise. Context matters: for a membership-dependent business, the actual risk may feel higher due to customer friction and revenue impact.

Frequently asked questions