CVSS base score
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
What the vulnerability does
The Simple Membership WordPress plugin before 4.7.7 does not verify that a PayPal payment notification was sent to the site's own configured merchant account before activating a membership, allowing unauthenticated users to activate or extend a membership using a payment made to an arbitrary PayPal account they control.
Explanation of Vulnerability in Simple Terms
Simple Membership versions before 4.7.7 contain an integrity vulnerability allowing unauthenticated attackers over the network to modify data without user interaction. The attack has low complexity and does not require special privileges. No confidentiality or availability impact is present. Update to version 4.7.7 or later to resolve this issue.
What an attacker can do
Modify data on the site without authentication or user interaction.
Potential impact on your site
Site data can be altered by unauthenticated attackers, potentially affecting content integrity.
Conditions required to exploit
Network access only; no authentication or user action required.
Key dates
External resources
