Simple Membership < 4.7.7 – Unauthenticated Payment Bypass via Missing PayPal IPN Receiver Verification | CVE 2026-14936

Description

The plugin does not verify that a PayPal payment notification was sent to the site's own configured merchant account before activating a membership, allowing unauthenticated users to activate or extend a membership using a payment made to an arbitrary PayPal account they control.

Proof of Concept

Prerequisites: Simple Membership active with PayPal configured as a payment gateway and at least one membership level / payment button (its standard setup).

A genuine PayPal VERIFIED postback cannot be forged; a real attacker uses a genuine payment to a PayPal account they control:

1. On the target site, register for a free/pending membership. Note the resulting member record id (swpm_id) and the target membership level id (subsc_ref); both are enumerable from the registration/payment pages.
2. In the attacker's own PayPal account, create a payment for a token amount whose IPN notify_url points at the site listener and whose custom field references the victim record:
     notify_url = https://victim.example/?swpm_process_ipn=1
     custom     = subsc_ref=<level_id>&swpm_id=<member_id>
     item_number= <any value that is NOT a real plugin payment button>   (causes the price check to be skipped)
3. Complete the payment to the attacker's own account. PayPal delivers a genuine IPN to the site listener; the listener posts it back and PayPal replies VERIFIED (the message is authentic to a real transaction).
4. Because the plugin never checks the payee against the site's configured merchant email, the VERIFIED notification is accepted: member <swpm_id> flips account_state from pending to active at membership level <subsc_ref>.

Result: a paid membership is granted on the target site while the site received no payment (the funds went to the attacker's own PayPal account).

Shape of the raw notification the unauthenticated listener consumes:
POST /?swpm_process_ipn=1
payment_status=Completed&txn_type=web_accept&txn_id=<real-paypal-txn>&mc_gross=1.00&mc_currency=USD&custom=subsc_ref=<level_id>&swpm_id=<member_id>&item_number=<non-plugin-button>&receiver_email=attacker@example.com&business=attacker@example.com