WordPress Subscriptions & Memberships for PayPal Plugin Unauthenticated Fake Payment Creation Vulnerability

A vulnerability exists in the Subscriptions & Memberships for PayPal plugin for WordPress, affecting all versions up to and including 1.1.7. The issue arises because the plugin fails to properly verify the authenticity of Instant Payment Notification (IPN) requests. This flaw allows unauthenticated attackers to create fake payment entries that do not reflect actual transactions.

Impact

Exploitation of this vulnerability allows for the creation of fraudulent payment entries in the WordPress site, potentially leading to unauthorized access or benefits associated with those payments.

Remediation

Users are advised to update the Subscriptions & Memberships for PayPal plugin to version 1.1.8 or a newer patched version.