Simple Membership, CVE-2026-88764

CVE, Research URL: CVE-2026-88764
Home page URL: Security reports for Simple Membership
Application: Simple Membership
Published on: Sep 13, 2026
Research Description: The Simple Membership WordPress plugin before 4.7.8 does not validate that the membership level supplied in a PayPal payment notification matches the level configured for the paid payment button, allowing members to pay for a lower-priced membership while being granted a higher, more privileged membership level.
Affected versions: max 4.7.8.
Status: vulnerable