Threats tagged 'ghsa-rx87-886c-g6fw'

A vulnerability in the Simple Membership WordPress plugin before version 4.7.7 allows unauthenticated users to activate or extend memberships by exploiting insufficient verification of PayPal payment notifications. The plugin does not confirm that the payment notification was sent to the site's configured merchant account, enabling attackers to use payments made to arbitrary PayPal accounts they control.