[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fxTiPUkJS7ZYylwKrQRpd5S3An3fIxKcJ4c5BcJFXLRs":3},{"id":4,"url_slug":5,"title":6,"description":7,"plugin_slug":8,"theme_slug":9,"affected_versions":10,"patched_in_version":11,"severity":12,"cvss_score":13,"cvss_vector":14,"vuln_type":15,"published_date":16,"updated_date":17,"references":18,"days_to_patch":20,"patch_diff_files":21,"patch_trac_url":9,"research_status":30,"research_verified":31,"research_rounds_completed":32,"research_plan":33,"research_summary":9,"research_vulnerable_code":9,"research_fix_diff":9,"research_exploit_outline":9,"research_model_used":34,"research_started_at":35,"research_completed_at":36,"research_error":9,"poc_status":9,"poc_video_id":9,"poc_summary":9,"poc_steps":9,"poc_tested_at":9,"poc_wp_version":9,"poc_php_version":9,"poc_playwright_script":9,"poc_exploit_code":9,"poc_has_trace":31,"poc_model_used":9,"poc_verification_depth":9,"poc_exploit_code_gated":31,"source_links":37},"CVE-2026-34886","simple-membership-missing-authorization","Simple Membership \u003C= 4.7.1 - Missing Authorization","The Simple Membership plugin for WordPress is vulnerable to unauthorized access due to a missing capability check on a function in all versions up to, and including, 4.7.1. This makes it possible for unauthenticated attackers to perform an unauthorized action.","simple-membership",null,"\u003C=4.7.1","4.7.2","medium",5.3,"CVSS:3.1\u002FAV:N\u002FAC:L\u002FPR:N\u002FUI:N\u002FS:U\u002FC:N\u002FI:L\u002FA:N","Missing Authorization","2026-03-31 00:00:00","2026-04-09 16:23:22",[19],"https:\u002F\u002Fwww.wordfence.com\u002Fthreat-intel\u002Fvulnerabilities\u002Fid\u002Fbd9336ba-0a91-4fe5-b564-1adf739f4193?source=api-prod",10,[22,23,24,25,26,27,28,29],"classes\u002Fadmin-includes\u002Fclass.swpm-payment-settings-menu-tab.php","classes\u002Fclass.simple-wp-membership.php","classes\u002Fclass.swpm-auth.php","classes\u002Fclass.swpm-front-registration.php","classes\u002Fclass.swpm-utils-member.php","classes\u002Fclass.swpm-utils-misc.php","classes\u002Fshortcode-related\u002Fclass.swpm-shortcodes-handler.php","ipn\u002Fswpm-stripe-webhook-handler.php","researched",false,3,"```markdown\n# Exploitation Research Plan: CVE-2026-34886 - Simple Membership Missing Authorization\n\n## 1. Vulnerability Summary\nThe Simple Membership plugin (versions \u003C= 4.7.1) contains a missing authorization vulnerability in the handling of payment settings. The function `SWPM_Payment_Settings_Menu_Tab::handle_payment_settings_menu_tab` (located in `classes\u002Fadmin-includes\u002Fclass.swpm-payment-settings-menu-tab.php`) was intended to be an admin-only management function. However, in vulnerable versions, the capability check `SwpmMiscUtils::check_user_permission_and_is_admin` was either missing or placed in a code path that could be bypassed. This allows unauthenticated attackers to trigger actions within this function, such as disconnecting PayPal accounts or modifying plugin settings, provided they can bypass or obtain the required nonces.\n\n## 2. Attack Vector Analysis\n*   **Endpoint**: `wp-admin\u002Fadmin-ajax.php` or any front-end page (via `wp_loaded` or `init` hooks).\n*   **Vulnerable Action**: The function `handle_payment_settings_menu_tab` processes several `$_GET` and `$_POST` parameters.\n*   **Target Parameters**:\n    *   `swpm_ppcp_disconnect_production`: Disconnects the live PayPal account.\n    *   `swpm_ppcp_disconnect_sandbox`: Disconnects the sandbox PayPal account","gemini-3-flash-preview","2026-04-17 22:05:29","2026-04-17 22:06:20",{"type":38,"vulnerable_version":39,"fixed_version":11,"vulnerable_browse":40,"vulnerable_zip":41,"fixed_browse":42,"fixed_zip":43,"all_tags":44},"plugin","4.7.1","https:\u002F\u002Fplugins.trac.wordpress.org\u002Fbrowser\u002Fsimple-membership\u002Ftags\u002F4.7.1","https:\u002F\u002Fdownloads.wordpress.org\u002Fplugin\u002Fsimple-membership.4.7.1.zip","https:\u002F\u002Fplugins.trac.wordpress.org\u002Fbrowser\u002Fsimple-membership\u002Ftags\u002F4.7.2","https:\u002F\u002Fdownloads.wordpress.org\u002Fplugin\u002Fsimple-membership.4.7.2.zip","https:\u002F\u002Fplugins.trac.wordpress.org\u002Fbrowser\u002Fsimple-membership\u002Ftags"]