CVE-2026-12093 is an authorization bypass vulnerability (CWE-862) in the Simple Membership WordPress plugin (wpinsider-1). The plugin fails to properly verify user authorization when processing Stripe webhook events. Specifically, attackers can forge a charge.refunded webhook event containing a victim's subscription ID, causing the plugin to set the member's account_state to 'inactive' and trigger cancellation hooks and notifications. This vulnerability affects all versions up to and including 4.7.5 but only when the Stripe webhook signing secret is not configured, which is the default out-of-the-box state. Configuring the stripe-webhook-signing-secret option routes webhook processing through a verified HMAC path, mitigating the issue.

An unauthenticated attacker can deactivate arbitrary member accounts by exploiting this vulnerability, causing denial of service to those members. The impact is limited to account deactivation and triggering of cancellation-related processes and notifications. There is no direct confidentiality or availability impact beyond account deactivation. The vulnerability requires the absence of a configured Stripe webhook signing secret to be exploitable.

There is no official patch or fix currently confirmed. However, the vulnerability is mitigated if the Stripe webhook signing secret is configured in the plugin settings. Site administrators should immediately configure the stripe-webhook-signing-secret option to enable webhook signature verification, which prevents unauthorized webhook event processing. Check the vendor advisory or plugin updates regularly for any official fixes or patches.