Simple Membership <= 4.8.6 - Unauthenticated Insecure Direct Object Reference to Paid Membership Claim via Stripe Checkout Return 'ref_id' and Paid Registration Link
- ID
- WPSEC-2026-2443
- Plugin
- Simple Membership (simple-membership)
- Affected
- from 3.9.0 before 4.8.7
- Remediation
- Update to 4.8.7 or later.
- CVSS 3.1
- CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N
- Weakness
- CWE-639
- Usage
- Plugin Medium · Affected versions Medium among sites WPSec scans, 2026-11-04
- Attack surface
- Simple Membership on WPSec AttackSurface
- Fix released
- Published
Description
The Simple Membership plugin for WordPress is vulnerable to Insecure Direct Object Reference via the Stripe SCA checkout return handlers (swpm_process_stripe_sca_buy_now and swpm_process_stripe_sca_subscription) and the paid registration link lookup in all versions up to, and including, 4.8.6. This is due to a predictable checkout reference ID (an MD5 hash of the buyer's IP address plus the public payment button ID), the return handlers not checking that the return URL is opened in the browser that started the checkout, and the pending paid registration link being found by IP address alone. This makes it possible for unauthenticated attackers who know the buyer's IP address, or who share it, to open a completed checkout's return URL before the buyer does, or to visit the thank-you page while the registration is still pending. They can then have another buyer's Stripe payment applied to their own logged-in member account, or get the buyer's paid registration link and claim a paid membership they did not pay for.
References
- https://wpsec.com/vuln/WPSEC-2026-2443/
- https://plugins.svn.wordpress.org/simple-membership/tags/4.8.7/
- https://wordpress.org/plugins/simple-membership/
Published by WPSec. Provided as is, without warranty. Corrections: contact us.
This advisory as JSON or Markdown · All advisories: JSON, RSS