The Simple Membership plugin for WordPress allows an unauthenticated attacker to forge Stripe webhook events because the plugin only verifies signatures when a stripe‑webhook‑signing‑secret is set, which is left empty by default. This improper handling of missing values enables manipulation of membership subscriptions, such as re‑activating expired memberships without payment or cancelling legitimate subscriptions. The consequence is unauthorized access to paid content and potential service disruption.

Affected systems include any WordPress site that has the Simple Membership plugin installed, with version numbers 4.7.0 or earlier. The issue resides in the Stripe webhook handler and related classes within the plugin. No information is available about specific installations beyond the plugin name and affected version range.

The vulnerability has a CVSS score of 6.5, indicating a moderate risk, and an EPSS score of less than 1 %, suggesting a very low probability of exploitation at present. Based on the description, the likely attack vector is sending forged HTTP POST requests to the plugin’s Stripe webhook endpoint, bypassing signature verification due to an empty signing‑secret. The attack requires no authentication and therefore can be executed from anywhere. The fact that the issue is not listed in the CISA KEV catalog indicates that it has not yet been widely exploited in the wild.