CVE-2026-11855: Simple Membership WordPress XSS Flaw

CVE-2026-11855 Overview

CVE-2026-11855 affects the Simple Membership WordPress plugin in versions prior to 4.7.5. The plugin fails to verify the authenticity of Stripe webhook requests when no signing secret is configured. It also does not escape a value taken from these requests before outputting it in an administrator notice. Unauthenticated attackers can inject arbitrary web scripts that execute in the context of a logged-in administrator. This behavior maps to a stored Cross-Site Scripting (XSS) issue triggered through a forged webhook payload.

Critical Impact
Unauthenticated attackers can execute arbitrary JavaScript in an administrator's browser session, enabling account takeover, plugin manipulation, or full site compromise.

Affected Products

Simple Membership WordPress plugin versions prior to 4.7.5
WordPress sites using Stripe integration without a configured webhook signing secret
Administrator sessions on affected WordPress installations

Discovery Timeline

2026-07-06 - CVE-2026-11855 published to NVD
2026-07-06 - Last updated in NVD database

Technical Details for CVE-2026-11855

Vulnerability Analysis

The Simple Membership plugin exposes a Stripe webhook endpoint that receives event data from Stripe's payment platform. When the plugin's Stripe signing secret is not configured, the webhook handler skips signature verification. Any unauthenticated network client can post a crafted JSON payload to this endpoint. The plugin then processes attacker-controlled fields as if they originated from Stripe.

One of the extracted values is later rendered inside an administrator notice in the WordPress admin dashboard. The plugin outputs this value without escaping it for HTML context. When an administrator loads the admin page, the injected markup executes in the administrator's authenticated browser session.

Execution in this context grants the attacker access to nonces, cookies, and administrative functionality. An attacker can create new administrator accounts, install malicious plugins, or modify site content through subsequent authenticated requests issued from the victim's browser.

Root Cause

Two defects combine to produce the vulnerability. First, missing authenticity verification on the Stripe webhook endpoint when no signing secret is set allows arbitrary callers to submit event data. Second, missing output escaping in the administrator notice renderer allows raw HTML and JavaScript from that payload to reach the DOM. The pattern corresponds to CWE-79 (Improper Neutralization of Input During Web Page Generation).

Attack Vector

The attack requires no authentication and no prior access to the target site. An attacker sends an HTTP POST request to the plugin's Stripe webhook URL containing a JSON body with malicious script content in a field the plugin later surfaces in an admin notice. The exploit completes when any administrator subsequently visits an admin page that renders the stored notice, satisfying the user interaction requirement in the attack chain.

See the WPScan Vulnerability Details for additional technical context on the vulnerable code path.

Detection Methods for CVE-2026-11855

Indicators of Compromise

Unexpected POST requests to the Simple Membership Stripe webhook endpoint from IP addresses outside Stripe's published ranges
New WordPress administrator accounts created shortly after webhook traffic to the plugin
Presence of <script> tags or JavaScript event handlers inside stored plugin option values or transients
Outbound requests from administrator browsers to unknown domains immediately after loading wp-admin pages

Detection Strategies

Inspect webhook request logs for payloads containing HTML tags, on*= event handlers, or JavaScript URI schemes
Compare source IPs of webhook requests against the official Stripe webhook IP allowlist
Scan the WordPress wp_options table for plugin-owned entries containing script content
Monitor administrator session activity for anomalous plugin installs, user creations, or theme edits

Monitoring Recommendations

Enable verbose logging on the WordPress reverse proxy or web application firewall for all /wp-json and plugin webhook paths
Alert on administrator account creation events occurring outside of change-control windows
Track file integrity changes to wp-content/plugins and wp-content/mu-plugins directories
Correlate admin dashboard access with preceding webhook traffic to the affected plugin

How to Mitigate CVE-2026-11855

Immediate Actions Required

Upgrade the Simple Membership plugin to version 4.7.5 or later on all WordPress sites
Configure a Stripe webhook signing secret in the plugin settings to enforce signature verification
Review WordPress administrator accounts and remove any unauthorized users created recently
Rotate administrator passwords and invalidate active sessions after patching

Patch Information

The vendor addressed the issue in Simple Membership version 4.7.5. The fix enforces Stripe webhook signature verification and escapes values before they are rendered in administrator notices. Refer to the WPScan Vulnerability Details for advisory metadata.

Workarounds

Restrict access to the Stripe webhook endpoint at the web server or WAF layer, allowing only Stripe's published IP ranges
Configure the Stripe webhook signing secret in the plugin to force authenticity checks even on older versions where supported
Temporarily disable the Simple Membership plugin on sites that do not require Stripe payments until the update is applied

bash

# Example nginx restriction limiting Stripe webhook access to Stripe IP ranges
location ~ ^/\?swpm_process_stripe_webhook {
    allow 3.18.12.63;
    allow 3.130.192.231;
    allow 13.235.14.237;
    allow 13.235.122.149;
    deny all;
}