CVE-2026-88764: CWE-269 Improper Privilege Management in Simple Membership
The Simple Membership WordPress plugin before 4.7.8 does not validate that the membership level supplied in a PayPal payment notification matches the level configured for the paid payment button, allowing members to pay for a lower-priced membership while being granted a higher, more privileged membership level.
AI Analysis
Technical Summary
CVE-2026-88764 is a vulnerability in the Simple Membership WordPress plugin prior to version 4.7.8. The plugin does not validate that the membership level specified in a PayPal payment notification corresponds to the membership level configured for the paid payment button. This improper privilege management (CWE-269) can be exploited by users to obtain higher membership privileges than those they paid for by manipulating payment notifications.
Potential Impact
An attacker can gain unauthorized elevated membership privileges by paying for a lower-priced membership but being granted a higher-level membership. This could lead to unauthorized access to restricted content or features within the membership system. The CVSS 3.1 base score is 5.4 (medium severity), reflecting limited confidentiality and integrity impact without availability impact.
Mitigation Recommendations
Upgrade the Simple Membership plugin to version 4.7.8 or later, where this validation issue is fixed. No other mitigation is indicated. Patch status is confirmed by the version boundary; versions before 4.7.8 are vulnerable.
CVE-2026-88764: CWE-269 Improper Privilege Management in Simple Membership
Description
The Simple Membership WordPress plugin before 4.7.8 does not validate that the membership level supplied in a PayPal payment notification matches the level configured for the paid payment button, allowing members to pay for a lower-priced membership while being granted a higher, more privileged membership level.
CVSS v3.1
Score 5.4medium
Affected software
Simple Membership
Weaknesses
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
CVE-2026-88764 is a vulnerability in the Simple Membership WordPress plugin prior to version 4.7.8. The plugin does not validate that the membership level specified in a PayPal payment notification corresponds to the membership level configured for the paid payment button. This improper privilege management (CWE-269) can be exploited by users to obtain higher membership privileges than those they paid for by manipulating payment notifications.
Potential Impact
An attacker can gain unauthorized elevated membership privileges by paying for a lower-priced membership but being granted a higher-level membership. This could lead to unauthorized access to restricted content or features within the membership system. The CVSS 3.1 base score is 5.4 (medium severity), reflecting limited confidentiality and integrity impact without availability impact.
Mitigation Recommendations
Upgrade the Simple Membership plugin to version 4.7.8 or later, where this validation issue is fixed. No other mitigation is indicated. Patch status is confirmed by the version boundary; versions before 4.7.8 are vulnerable.
Technical Details
- Data Version
- 5.2
- Assigner Short Name
- WPScan
- Date Reserved
- 2026-09-10T06:55:42.278Z
- Cvss Version
- 3.1
- State
- PUBLISHED
Threat ID: 6aa682ae55bf5e2cf583e197
Added to database: 09/13/2026, 11:02:06 UTC
Last enriched: 09/13/2026, 11:17:07 UTC
Last updated: 09/14/2026, 01:04:29 UTC
Views: 15
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
External Links
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.