{"id":"CVE-2026-14936","aliases":["EUVD-2026-54193","GHSA-rx87-886c-g6fw"],"status":"published","title":"Simple Membership \u003c 4.7.7 - Unauthenticated Payment Bypass via Missing PayPal IPN Receiver Verification","description":"The Simple Membership WordPress plugin before 4.7.7 does not verify that a PayPal payment notification was sent to the site's own configured merchant account before activating a membership, allowing unauthenticated users to activate or extend a membership using a payment made to an arbitrary PayPal account they control.","severity":{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N","level":"medium","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-11","score":0.00163,"percentile":0.05531,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":false},"cwes":["CWE-345"],"published":"2026-08-06T17:04:20Z","modified":"2026-08-26T16:31:16Z","products":[{"vendor":"unknown","product":"simple membership"},{"vendor":"wpinsider-1","product":"simple membership"}],"references":[{"url":"https://wpscan.com/vulnerability/82ac8cd9-db44-49c7-905c-16d261c5c516/","tags":["exploit","vdb-entry","technical-description"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-14936"},{"url":"https://wpscan.com/vulnerability/82ac8cd9-db44-49c7-905c-16d261c5c516"},{"url":"https://github.com/advisories/GHSA-rx87-886c-g6fw"}],"sources":{"cve":[{"id":"CVE-2026-14936","title":"Simple Membership \u003c 4.7.7 - Unauthenticated Payment Bypass via Missing PayPal IPN Receiver Verification","description":"The Simple Membership WordPress plugin before 4.7.7 does not verify that a PayPal payment notification was sent to the site's own configured merchant account before activating a membership, allowing unauthenticated users to activate or extend a membership using a payment made to an arbitrary PayPal account they control.","status":"published","published":"2026-08-06T17:04:20.749Z","modified":"2026-08-07T14:04:36.301Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N","level":"medium","assessor":"cna"}],"cwes":["CWE-345"],"updated_at":"2026-11-02T13:38:32.13011Z"}],"euvd":[{"id":"EUVD-2026-54193","description":"The Simple Membership WordPress plugin before 4.7.7 does not verify that a PayPal payment notification was sent to the site's own configured merchant account before activating a membership, allowing unauthenticated users to activate or extend a membership using a payment made to an arbitrary PayPal account they control.","status":"published","published":"2026-08-06T17:04:20Z","modified":"2026-08-07T14:04:36Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N","level":"medium"}],"updated_at":"2026-11-02T18:02:07.294457Z"}],"ghsa":[{"id":"GHSA-rx87-886c-g6fw","title":"The Simple Membership WordPress plugin before 4.7.7 does not verify that a PayPal payment...","description":"The Simple Membership WordPress plugin before 4.7.7 does not verify that a PayPal payment notification was sent to the site's own configured merchant account before activating a membership, allowing unauthenticated users to activate or extend a membership using a payment made to an arbitrary PayPal account they control.","status":"published","published":"2026-08-07T00:31:14Z","modified":"2026-08-07T15:33:10Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N","level":"medium"}],"cwes":["CWE-345"],"updated_at":"2026-11-02T15:10:11.66732Z"}],"nvd":[{"id":"CVE-2026-14936","description":"The Simple Membership WordPress plugin before 4.7.7 does not verify that a PayPal payment notification was sent to the site's own configured merchant account before activating a membership, allowing unauthenticated users to activate or extend a membership using a payment made to an arbitrary PayPal account they control.","status":"published","published":"2026-08-06T22:16:47.327Z","modified":"2026-08-26T16:31:16.753Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N","level":"medium","assessor":"secondary"}],"cwes":["CWE-345"],"updated_at":"2026-11-02T14:12:35.386166Z"}]}}