CVE-2026-14936

MediumCVSS 5.3/10Last modified Aug 26, 2026

Description

The Simple Membership WordPress plugin before 4.7.7 does not verify that a PayPal payment notification was sent to the site's own configured merchant account before activating a membership, allowing unauthenticated users to activate or extend a membership using a payment made to an arbitrary PayPal account they control.

Metrics

CVSS 3.1 5.3/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N

Weakness enumeration

CWE-345

Affected software

No affected versions have been published.

Timeline

Published: Aug 6, 2026
Last modified: Aug 26, 2026
NVD status: Deferred

Related CVEs from 2026

CVE-2026-149384.3The FluentBoards WordPress plugin before 1.95.3 does not verify that the items selected for a board import operation belong to a board the CVE-2026-149396.8The Visualizer WordPress plugin before 4.0.6 does not restrict a user-supplied URL to safe address ranges before fetching it server-side, a CVE-2026-149405.3A heap-buffer-overflow flaw was found in 389 Directory Server (389-ds-base). When normalizing a Distinguished Name (DN) that contains a lega CVE-2026-149415.4The Customer Reviews for WooCommerce WordPress plugin before 5.116.0 does not perform nonce or capability checks on several settings-related CVE-2026-149437.5The Password Protected — Lock Entire Site, Pages, Posts, Categories, and Partial Content WordPress plugin before 2.8.4 does not restrict RES CVE-2026-149467.2A high privileged remote attacker can upload a .php file and then request it directly from /uploads/<filename>.php to achieve arbitrary code CVE-2026-149477.2A high-privileged remote attacker can upload malicious ZIP archive containing directory traversal sequences such as ../ can escape the inten CVE-2026-149488.8A low privileged remote attacker can hijack an active administrative session without needing to know the administrator password by extractin CVE-2026-149496.5A low privileged remote attacker with a valid session can submit a request to the user creation functionality exposed through /api/user/add.CVE-2026-14956.5The vulnerability, if exploited, could allow an attacker with Event Log Reader (S-1-5-32-573) privileges to obtain proxy details, including CVE-2026-149509.8An unauthenticated remote attacker in possession of a valid session identifier is able to continue using the session after it should have ex CVE-2026-149518.0An low privileged remote attacker can cause authenticated users to perform unintended actions in the FDS Web interface using malicious web p