Paid Memberships Pro Plugin: Stripe Webhook Vulnerability CVE-2026-4100

title: CVE-2026-4100 - Paid Memberships Pro Stripe Webhook Unauthorized Modification
id: scw-2026-05-02-ai-1
status: experimental
level: high
description: |
  This rule detects attempts to create or modify Stripe webhook configurations via the Paid Memberships Pro plugin's AJAX handlers. Attackers with subscriber-level access can exploit this vulnerability (CVE-2026-4100) to disrupt payment processing and subscription synchronization by creating, deleting, or rebuilding webhooks without proper authorization. This detection focuses on the specific AJAX action 'pmpro_stripe_create_webhook' which is part of the vulnerability.
author: SCW Feed Engine (AI-generated)
date: 2026-05-02
references:
  - https://shimiscyberworld.com/posts/nvd-CVE-2026-4100/
tags:
  - attack.impact
  - attack.t1531
logsource:
    category: webserver
detection:
  selection:
      cs-uri|contains:
          - '/wp-admin/admin-ajax.php'
      cs-uri-query|contains:
          - 'action=pmpro_stripe_create_webhook'
      cs-method|contains:
          - 'POST'
      sc-status|startswith:
          - '2'
  selection_user:
      User|contains:
          - 'subscriber'
  condition: selection AND selection_user
falsepositives:
  - Legitimate administrative activity

Source: Shimi's Cyber World · License & reuse