CVE-2026-12093
Description
The Simple Membership plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 4.7.5. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for unauthenticated attackers to deactivate arbitrary member accounts by forging a charge.refunded webhook event containing a victim's subscription ID, setting the target member's account_state to 'inactive' and triggering cancellation hooks, transaction-record status changes, and cancellation notification emails. This vulnerability is exploitable only on installations where no Stripe webhook signing secret has been configured, which is the default out-of-the-box state; sites that have configured the stripe-webhook-signing-secret option are routed to the properly verified HMAC path and are not affected.
Summary dbcve.org
The Simple Membership WordPress plugin up to version 4.7.5 lacks proper authorization checks on Stripe webhook handling, allowing unauthenticated attackers to deactivate member accounts by forging charge.refunded events with arbitrary subscription IDs. This only affects installations where the stripe-webhook-signing-secret option remains unconfigured (the default state).
Mitigation
Configure a Stripe webhook signing secret in the plugin settings to enable HMAC verification, or update to a patched version when available.