CVE-2026-12093

Name of the Vulnerable Software and Affected Versions Simple Membership versions prior to 4.7.6

Description An authorization bypass exists because the software fails to properly verify if a user is authorized to perform specific actions. Unauthenticated attackers can deactivate arbitrary member accounts by forging a charge.refunded webhook event. By including a victim's subscription ID, the attacker can set the account state of the target member to 'inactive', which triggers cancellation hooks, changes transaction-record statuses, and sends cancellation notification emails. This issue only affects installations where no Stripe webhook signing secret has been configured, as those with the stripe-webhook-signing-secret option enabled are routed through a verified HMAC (Hash-based Message Authentication Code) path.

Recommendations Update to a version later than 4.7.5. Configure the stripe-webhook-signing-secret option to ensure webhook events are properly verified via HMAC.