CVE-2026-14936: Unknown Simple Membership

Medium severity, CVSS 5.3. EPSS: 0.2% chance of exploitation in the next 30 days.

The Simple Membership WordPress plugin before 4.7.7 does not verify that a PayPal payment notification was sent to the site's own configured merchant account before activating a membership, allowing unauthenticated users to activate or extend a membership using a payment made to an arbitrary PayPal account they control.

Affected products

• Unknown Simple Membership: before 4.7.7 (fixed in 4.7.7)

Published 2026-08-06. Last modified 2026-08-26.