CVE-2026-1461: WordPress Simple Membership Auth Bypass

CVE-2026-1461 Overview

The Simple Membership plugin for WordPress contains an Improper Handling of Missing Values vulnerability (CWE-230) in all versions up to and including 4.7.0. The vulnerability exists in the Stripe webhook handler, where webhook signatures are only validated when the stripe-webhook-signing-secret setting is configured. Since this setting is empty by default, unauthenticated attackers can forge Stripe webhook events to manipulate membership subscriptions without proper authorization.

Critical Impact

Unauthenticated attackers can forge Stripe webhook events to reactivate expired memberships without payment, cancel legitimate subscriptions, and potentially gain unauthorized access to premium content while causing service disruption for legitimate paying members.

Affected Products

• Simple Membership Plugin for WordPress versions up to and including 4.7.0
• WordPress sites using Simple Membership with Stripe payment integration
• Installations with unconfigured stripe-webhook-signing-secret (default state)

Discovery Timeline

• February 19, 2026 - CVE-2026-1461 published to NVD
• February 19, 2026 - Last updated in NVD database

Technical Details for CVE-2026-1461

Vulnerability Analysis

This vulnerability stems from a missing validation check in the Simple Membership plugin's Stripe webhook processing code. The plugin exposes a webhook endpoint that receives payment and subscription events from Stripe. The security flaw lies in how the plugin handles webhook signature verification—it only performs verification when the stripe-webhook-signing-secret setting has been explicitly configured by the administrator.

Since WordPress plugins typically install with empty or default configuration values, most installations would have this security setting unset. When the signing secret is empty, the webhook handler accepts and processes any incoming request that matches the expected Stripe event structure, regardless of its origin. This allows attackers to craft malicious webhook payloads that the plugin will process as legitimate Stripe events.

The vulnerability can be exploited to modify membership statuses in several ways: attackers can send forged customer.subscription.updated events to reactivate expired memberships, invoice.payment_succeeded events to grant access without actual payment, or customer.subscription.deleted events to cancel legitimate subscriber accounts.

Root Cause

The root cause is an insecure default configuration combined with improper conditional logic for security controls. The vulnerable code in swpm-stripe-webhook-handler.php only invokes signature verification when a signing secret exists. The proper security approach would be to either require the signing secret configuration before enabling webhook processing, or to reject all webhook requests when signature verification cannot be performed.

Attack Vector

The attack can be executed remotely over the network without any authentication. An attacker identifies a WordPress site running the Simple Membership plugin with Stripe integration by detecting the webhook endpoint. They then craft HTTP POST requests mimicking Stripe webhook events with fabricated subscription or payment data. Without the signing secret configured, the plugin processes these forged events as legitimate, allowing the attacker to manipulate membership records directly.

The attacker could enumerate membership levels and user accounts through repeated probing, then selectively activate premium memberships for themselves or disrupt service for legitimate users by canceling their subscriptions.

Detection Methods for CVE-2026-1461

Indicators of Compromise

• Unexpected membership status changes without corresponding Stripe dashboard activity
• Membership activations or renewals without matching payment records
• Webhook requests to /swpm-stripe-webhook-handler.php from non-Stripe IP addresses
• Sudden increase in webhook endpoint traffic volume
• User complaints about unauthorized subscription cancellations

Detection Strategies

• Monitor web server access logs for POST requests to the Stripe webhook handler endpoint from IP addresses outside Stripe's documented IP ranges
• Implement application-level logging for all membership status changes and correlate with Stripe dashboard events
• Deploy web application firewall (WAF) rules to detect malformed or suspicious webhook payloads
• Set up alerts for membership changes occurring outside normal business patterns

Monitoring Recommendations

• Enable verbose logging for the Simple Membership plugin to track all webhook processing events
• Configure Stripe dashboard alerts for subscription changes and cross-reference with WordPress membership records
• Monitor database tables for membership record modifications and audit timestamp discrepancies
• Implement integrity monitoring on plugin files to detect any unauthorized modifications

How to Mitigate CVE-2026-1461

Immediate Actions Required

• Update the Simple Membership plugin to the latest patched version beyond 4.7.0 immediately
• Configure the stripe-webhook-signing-secret setting with the signing secret from your Stripe dashboard
• Audit membership records for any unauthorized changes that may have occurred before patching
• Review Stripe dashboard activity and reconcile with membership database records
• Consider temporarily disabling the Stripe webhook endpoint until the patch is applied

Patch Information

The vulnerability has been addressed in WordPress Changeset #3453404. Administrators should update to the patched version through the WordPress plugin update mechanism or by downloading the latest release from the WordPress Plugin Directory. Additional technical analysis is available from the Wordfence Vulnerability Report.

Workarounds

• Configure the stripe-webhook-signing-secret setting in Simple Membership with your Stripe webhook signing secret (available in Stripe Dashboard under Developers → Webhooks)
• Implement IP-based access restrictions on your web server to only allow Stripe's webhook IP addresses to reach the handler endpoint
• Deploy a web application firewall rule to validate incoming webhook payloads before they reach the plugin
• As a temporary measure, disable Stripe payment integration until the plugin can be updated

# Configuration example - Restrict webhook access to Stripe IP ranges in Apache .htaccess
# Add to your WordPress .htaccess or virtual host configuration
<Files "swpm-stripe-webhook-handler.php">
    Require ip 3.18.12.63
    Require ip 3.130.192.231
    Require ip 13.235.14.237
    Require ip 13.235.122.149
    Require ip 18.211.135.69
    Require ip 35.154.171.200
    Require ip 52.15.183.38
    Require ip 54.88.130.119
    Require ip 54.88.130.237
    Require ip 54.187.174.169
    Require ip 54.187.205.235
    Require ip 54.187.216.72
</Files>