WordPress Membership Plugin Webhook Signature Verification Bypass

The User Registration & Membership WordPress plugin before version 5.2.2 contains a critical authentication flaw in its webhook handling mechanism. When payment providers send notifications to confirm successful transactions, the plugin fails to cryptographically verify that these notifications actually originated from the legitimate payment provider. This allows attackers to craft forged webhook messages that trick the plugin into believing a payment was completed when no actual transaction occurred. Any WordPress site running this vulnerable plugin version is exposed, particularly those offering paid memberships or subscriptions. The impact is severe: attackers gain immediate access to premium content and services without paying, directly enabling fraud and revenue loss for site operators.

While this specific CVE currently maps to zero Casky skills due to its recent discovery, the underlying attack pattern falls within critical security domains that Claude AI with extended reasoning can surface through behavioral analysis. A practitioner using Casky would identify this vulnerability through detection of forged API calls and unauthorized state changes (techniques like T1195 Supply Chain Compromise and T1583 Acquire Infrastructure). The platform's extended reasoning would flag suspicious webhook processing patterns—specifically the absence of signature validation routines in payment flow handlers—and correlate this with MITRE techniques such as T1021 Remote Services and T1078 Valid Accounts, revealing how attackers exploit the trust boundary between the plugin and external payment systems. This gap in webhook authentication represents a fundamental failure in the Secure Development practice domain that Casky's skills framework helps practitioners remediate before deployment.