# Simple Membership <= 4.8.6 - Unauthenticated Insecure Direct Object Reference to Paid Membership Claim via Stripe Checkout Return 'ref_id' and Paid Registration Link

- **ID:** WPSEC-2026-2443
- **Plugin:** Simple Membership (`simple-membership`), https://wordpress.org/plugins/simple-membership/
- **Affected versions:** from 3.9.0 before 4.8.7
- **Fixed in:** 4.8.7 (Update to 4.8.7 or later.)
- **Severity:** Medium 4.8 (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N)
- **Weakness:** CWE-639
- **Usage among sites WPSec scans:** plugin Medium, affected versions Medium (as of 2026-11-04)
- **Attack surface analysis:** https://attacksurface.wpsec.com/plugin/simple-membership
- **Fix released:** 2026-11-03
- **Published:** 2026-11-04
- **URL:** https://wpsec.com/vuln/WPSEC-2026-2443/

## Description

The Simple Membership plugin for WordPress is vulnerable to Insecure Direct Object Reference via the Stripe SCA checkout return handlers (swpm_process_stripe_sca_buy_now and swpm_process_stripe_sca_subscription) and the paid registration link lookup in all versions up to, and including, 4.8.6. This is due to a predictable checkout reference ID (an MD5 hash of the buyer's IP address plus the public payment button ID), the return handlers not checking that the return URL is opened in the browser that started the checkout, and the pending paid registration link being found by IP address alone. This makes it possible for unauthenticated attackers who know the buyer's IP address, or who share it, to open a completed checkout's return URL before the buyer does, or to visit the thank-you page while the registration is still pending. They can then have another buyer's Stripe payment applied to their own logged-in member account, or get the buyer's paid registration link and claim a paid membership they did not pay for.

## References

- https://wpsec.com/vuln/WPSEC-2026-2443/
- https://plugins.svn.wordpress.org/simple-membership/tags/4.8.7/
- https://wordpress.org/plugins/simple-membership/

Source: WPSec, https://wpsec.com/vuln/WPSEC-2026-2443/

License: CC BY 4.0 (https://creativecommons.org/licenses/by/4.0/). Free to use, share and adapt, also commercially, if you credit WPSec and link to this advisory.