The Simple Membership WordPress plugin, released before version 4.7.7, contains a flaw that fails to verify that a PayPal payment notification (IPN) originated from the site’s legitimate merchant account. This is an instance of CWE-345, a type of insufficient authentication weakness. As a result, anyone who controls a PayPal account can send a forged IPN to the plugin, causing the system to activate or extend a user’s membership without authenticating the payment. This allows unauthorized users to gain access to paid content or restricted features normally protected by membership status.

The in‐vendor name for the affected product is Simple Membership for WordPress. Versions of the plugin older than 4.7.7 are vulnerable; the issue exists in all releases prior to that point. No further sub‑version detail is available from the vendor.

The CVSS score of 5.3 indicates a moderate risk level. The EPSS score of < 1% indicates a very low probability of exploitation in the wild, but the absence of authentication on the IPN endpoint makes exploitation trivial for anyone who can exercise control of a PayPal account. Because the vulnerability is not listed in CISA’s KEV catalog, there is currently no evidence of public exploitation. Attackers would craft a POST request emulating a PayPal IPN to the plugin’s endpoint, and since the plugin does not check the merchant_id, the membership activation logic will be executed without further checks. This could lead to revenue loss, unauthorized data access, and friction in membership management for site administrators.