CVE-2026-12093: wordpress simple-membership Missing Authorization

Vulnerability summary

CVE-2026-12093 is a medium (CVSS 5.3) Missing Authorization vulnerability in wordpress simple-membership. EPSS estimates a 0.35% chance of exploitation in the next 30 days, higher than 27.3% of scored vulnerabilities. Fixed in 4.7.6.

Timeline

1. 18-06-2026
   PublishedVulnerability first disclosed.
2. 18-06-2026
   Last modifiedVulnerability information updated.

Description

The Simple Membership plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 4.7.5. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for unauthenticated attackers to deactivate arbitrary member accounts by forging a charge.refunded webhook event containing a victim's subscription ID, setting the target member's account_state to 'inactive' and triggering cancellation hooks, transaction-record status changes, and cancellation notification emails. This vulnerability is exploitable only on installations where no Stripe webhook signing secret has been configured, which is the default out-of-the-box state; sites that have configured the stripe-webhook-signing-secret option are routed to the properly verified HMAC path and are not affected.

• CWE-862Missing AuthorizationThe product does not perform an authorization check when an actor attempts to access a resource or perform an action.