CVE-2026-1461— Simple Membership <= 4.7.0 - Unauthenticated Improper Handling of Missing Values
Quick assessment
Affected
wpinsider-1 Simple Membership
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.
WordPress和WordPress plugin都是WordPress基金会的产品。WordPress是一套使用PHP语言开发的博客平台。该平台具有在基于PHP和MySQL的服务器上架设个人博客网站的功能。WordPress plugin是一个应用插件。 WordPress plugin Simple Membership 4.7.0及之前版本存在安全漏洞，该漏洞源于对缺失值处理不当，可能导致伪造Webhook事件以操纵会员订阅。
Possible ATT&CK Techniques 1 AI
T1190 · Exploit Public-Facing Application
Get alerts for future matching vulnerabilities
Log in to subscribe
I. Basic Information for CVE-2026-1461
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
Simple Membership <= 4.7.0 - Unauthenticated Improper Handling of Missing Values
Source: CVE Program / CVE List V5
Vulnerability Description
The Simple Membership plugin for WordPress is vulnerable to Improper Handling of Missing Values in all versions up to, and including, 4.7.0 via the Stripe webhook handler. This is due to the plugin only validating webhook signatures when the stripe-webhook-signing-secret setting is configured, which is empty by default. This makes it possible for unauthenticated attackers to forge Stripe webhook events to manipulate membership subscriptions, including reactivating expired memberships without payment or canceling legitimate subscriptions, potentially leading to unauthorized access and service disruption.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N
Source: CVE Program / CVE List V5
Vulnerability Type
缺失值处理不恰当
Source: CVE Program / CVE List V5
Vulnerability Title
WordPress plugin Simple Membership 安全漏洞
Source: CNNVD (China National Vulnerability Database)
Vulnerability Description
WordPress和WordPress plugin都是WordPress基金会的产品。WordPress是一套使用PHP语言开发的博客平台。该平台具有在基于PHP和MySQL的服务器上架设个人博客网站的功能。WordPress plugin是一个应用插件。 WordPress plugin Simple Membership 4.7.0及之前版本存在安全漏洞，该漏洞源于对缺失值处理不当，可能导致伪造Webhook事件以操纵会员订阅。
Source: CNNVD (China National Vulnerability Database)
CVSS Information
N/A
Source: CNNVD (China National Vulnerability Database)
Vulnerability Type
N/A
Source: CNNVD (China National Vulnerability Database)
Affected Products
| Vendor | Product | Affected Versions | CPE | Subscribe |
|---|---|---|---|---|
| wpinsider-1 | Simple Membership | * ~ 4.7.0 | - |
|
II. Public POCs for CVE-2026-1461
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POC
Premium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2026-1461
请登录查看更多情报信息。
IV. Related Vulnerabilities
Same product: Simple Membership
-
CVE-2026-97337
Simple Membership <= 4.8.3 - Missing Authorization to Unauth -
CVE-2026-74000
WordPress Simple Membership plugin <= 4.8.2 - Broken Access -
CVE-2026-88764
Simple Membership < 4.7.8 - Subscriber+ Membership Level Esc -
CVE-2026-77194
Simple Membership <= 4.8.1 - Unauthenticated Authentication -
CVE-2026-14936
Simple Membership < 4.7.7 - Unauthenticated Payment Bypass v
Same vendor: wpinsider-1
-
CVE-2026-97337
Simple Membership <= 4.8.3 - Missing Authorization to Unauth -
CVE-2026-77194
Simple Membership <= 4.8.1 - Unauthenticated Authentication -
CVE-2026-12093
Simple Membership <= 4.7.5 - Missing Authorization to Unauth -
CVE-2024-11088
Simple Membership <= 4.5.5 - Exposure of Private Personal In -
CVE-2024-4383
Simple Membership <= 4.4.5 - Authenticated(Contributor+) Sto
Same weakness: CWE-230
-
CVE-2026-25659
Ericsson Packet Core Gateway (PCG) - Improper handling of mi -
CVE-2026-25658
Ericsson Packet Core Gateway (PCG) - Improper handling of mi -
CVE-2026-20086
Cisco IOS XE Wireless Controller software 安全漏洞 -
CVE-2025-23225
IBM MQ denial of service -
CVE-2024-11024
AppPresser – Mobile App Framework <= 4.4.6 - Unauthenticated
V. Comments for CVE-2026-1461
No comments yet