WordPress Plugin Vulnerabilities

Subscriptions & Memberships for PayPal < 1.1.8 - Unauthenticated Fake Payment Creation

Description

The Subscriptions & Memberships for PayPal plugin for WordPress is vulnerable to fake payment creation in all versions up to, and including, 1.1.7. This is due to the plugin not properly verifying the authenticity of an IPN request. This makes it possible for unauthenticated attackers to create fake payment entries that have not actually occurred.

Affects Plugins

Plugin icon
subscriptions-memberships-for-paypal
Fixed in 1.1.8

References

CVE
CVE-2025-12752
URL
https://www.wordfence.com/threat-intel/vulnerabilities/id/8f706b78-2d67-442c-b7a0-7d7a0fd24b2d

Classification

Type
CONTENT INJECTION
OWASP top 10
A1: Injection
CWE
CWE-345
CVSS
5.3 (medium)

Miscellaneous

Original Researcher
Md. Moniruzzaman Prodhan (NomanProdhan)
Verified
No
WPVDB ID
eaac5423-ef27-4c38-b0ec-5483d45fc343

Timeline

Publicly Published
2025-11-21 (about 9 months ago)
Added
2025-11-21 (about 9 months ago)
Last Updated
2025-11-22 (about 9 months ago)

Other

Published
Title
Published
2026-02-11
Title
WooODT Lite < 2.5.6 - Unauthenticated Payment Bypass
Published
2025-12-12
Title
TI WooCommerce Wishlist < 2.11.0 - Unauthenticated HTML Injection
Published
2023-10-03
Title
WP Content Pilot – Autoblogging & Affiliate Marketing Plugin < 1.3.4 - Authenticated (Contributor+) Content Injection
Published
2024-10-16
Title
Calculated Fields Form < 5.2.46 - HTML Injection
Published
2026-04-06
Title
Charitable – Donation Plugin for WordPress – Fundraising with Recurring Donations & More < 1.8.10 - Insufficient Verification of Data Authenticity to Unauthenticated Donation Status Forgery via Stripe Webhook