Nikita Fenko

**Name of the Vulnerable Software and Affected Versions** Simple Membership versions prior to 4.7.6 **Description** An authorization bypass exists because the software fails to properly verify if a user is authorized to perform specific actions. Unauthenticated attackers can deactivate arbitrary member accounts by forging a `charge.refunded` webhook event. By including a victim's subscription ID, the attacker can set the `account state` of the target member to 'inactive', which triggers cancellation hooks, changes transaction-record statuses, and sends cancellation notification emails. This issue only affects installations where no Stripe webhook signing secret has been configured, as those with the `stripe-webhook-signing-secret` option enabled are routed through a verified HMAC (Hash-based Message Authentication Code) path. **Recommendations** Update to a version later than 4.7.5. Configure the `stripe-webhook-signing-secret` option to ensure webhook events are properly verified via HMAC.