CVE-2026-11855
HighCVSS 8.8Exploitation Probability (EPSS)
Low risk22th percentile - higher than 22% of all known CVEs
Summary
The Simple Membership WordPress plugin before version 4.7.5 does not verify the authenticity of Stripe webhook requests when no signing secret is configured, nor escapes a value taken from them before outputting it in an administrator notice, allowing unauthenticated attackers to inject arbitrary web scripts that execute in the context of a logged-in administrator.
Risk Assessment
The risk involves potential session hijacking, data theft, or further attack escalation within the WordPress environment, potentially leading to full site compromise.
Recommendation
Immediately update the Simple Membership plugin to version 4.7.5 or later and configure a signing secret for Stripe webhooks to ensure request authenticity verification.
Original NVD description (English source)
The Simple Membership WordPress plugin before 4.7.5 does not verify the authenticity of Stripe webhook requests when no signing secret is configured, nor escape a value taken from them before outputting it in an administrator notice, allowing unauthenticated attackers to inject arbitrary web scripts that execute in the context of a logged-in administrator.