CVE-2026-97337

Broken Access Control vulnerability in Simple Membership plugin up to version 4.8.2, allowing Contributor accounts to access admin functions. This enables privilege escalation.

The Simple Membership WordPress plugin before version 4.7.8 does not verify whether user creation failed during registration before using the returned value as a user ID to update an account. This allows unauthenticated attackers to overwrite the primary administrator's account data (including the email address) and take over that account through the password reset flow.

The Simple Membership plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'country' parameter in all versions up to and including 4.8.4 due to insufficient input sanitization and output escaping. This allows authenticated attackers with subscriber-level access and above to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Unauthenticated attackers may also exploit this vulnerability when the plugin's Enable Free Membership feature is turned on, as it permits anonymous front-end registration and profile submission.

The Simple Membership WordPress plugin before 4.7.8 does not validate that the membership level supplied in a PayPal payment notification matches the level configured for the paid payment button. This allows members to pay for a lower-priced membership while being granted a higher, more privileged membership level.

The Simple Membership plugin for WordPress is vulnerable to Authentication Bypass leading to Administrator Account Takeover in versions up to, and including, 4.8.0. This is due to improper identity verification during the public registration flow in WordPress Multisite environments, where the plugin binds new Simple Membership records to existing global WordPress users based solely on matching username and email, without requiring password verification or ownership proof, and fails to properly detect Administrator roles on child sites. This makes it possible for unauthenticated attackers to take over Administrator accounts on child sites in a Multisite network by registering a Simple Membership account with a victim's credentials on a site where public registration is enabled, then updating the victim's global WordPress password through the profile edit functionality. The vulnerability was partially patched in version 4.8.1.

The Simple Membership WordPress plugin before 4.7.7 does not verify that a PayPal payment notification was sent to the site's own configured merchant account before activating a membership. This allows unauthenticated users to activate or extend a membership using a payment made to an arbitrary PayPal account they control.

Unauthenticated Broken Access Control in Simple Membership <= 4.7.8 versions.

The Simple Membership WordPress plugin before version 4.7.8 does not sanitize a subscriber name value received from an unauthenticated payment approval request, nor escape it when displaying it in the administration dashboard. This allows unauthenticated attackers to store arbitrary JavaScript that executes in an administrator's session.

The Simple Membership WordPress plugin before version 4.7.5 does not verify the authenticity of Stripe webhook requests when no signing secret is configured, nor escapes a value taken from them before outputting it in an administrator notice, allowing unauthenticated attackers to inject arbitrary web scripts that execute in the context of a logged-in administrator.

There is an unauthenticated Cross Site Scripting (XSS) vulnerability in Simple Membership versions <= 4.7.2. An attacker can exploit this flaw to inject malicious scripts.