Simple Membership < 4.7.8 – Subscriber+ Membership Level Escalation via PayPal Standard subsc_ref | CVE 2026-88764

Description

The plugin does not validate that the membership level supplied in a PayPal payment notification matches the level configured for the paid payment button, allowing members to pay for a lower-priced membership while being granted a higher, more privileged membership level.

Proof of Concept

Prerequisites (normal site setup):
- Simple Membership <= 4.7.7 active with PayPal Standard payments enabled.
- Two membership levels, e.g. Basic (low price) and Premium (higher price), each mapped to a WordPress role in the level settings.
- A PayPal Standard "Buy Now" button for the Basic level.

Steps:
1. Register (or already hold) a Basic membership account on the site.
2. Open the Basic membership payment page and start the PayPal Standard checkout. In the submitted PayPal form there is a hidden custom field that encodes the level being purchased, of the form:
   subsc_ref=<BASIC_LEVEL_ID>&user_ip=<ip>&swpm_id=<your member id>
3. Change ONLY the level id in that custom field to the higher tier, i.e. subsc_ref=<PREMIUM_LEVEL_ID>. Leave the merchant email, amount, currency, Basic button/item number and your member id unchanged.
4. Complete the genuine PayPal payment for the low Basic price (e.g. 1.00 USD).
5. PayPal delivers the payment notification to the site, echoing the custom field verbatim, and confirms it as VERIFIED. The plugin verifies the merchant and the Basic amount, then sets the membership level from the custom field's level id.

The verified notification the site processes is equivalent to:

POST https://victim.example/?swpm_process_ipn=1
Content-Type: application/x-www-form-urlencoded

payment_status=Completed&txn_type=web_accept&txn_id=UNIQUE123&mc_gross=1.00&mc_currency=USD&item_number=<BASIC_BUTTON_ID>&item_name=Basic&quantity=1&receiver_email=<merchant email>&payer_email=<attacker email>&custom=subsc_ref%3D<PREMIUM_LEVEL_ID>%26user_ip%3D1.2.3.4%26swpm_id%3D<attacker member id>

Result: the account is upgraded to the Premium level (and the higher role the admin mapped to it) after paying only the Basic price.