EUVD-2026-52175
GHSA-7g75-5pmj-3v8p
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:H
Unauthenticated network attack (AV:N/PR:N/UI:N) with low complexity; outcome is full admin takeover, so C/I/A all High rather than the official C:L.
Primary rating from Vendor (WPScan).
CVSS VectorVendor: WPScan
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:H
Lifecycle Timeline
5DescriptionCVE.org
The Simple Membership WordPress plugin before 4.7.8 does not verify whether user creation failed during registration before using the returned value as a user ID to update an account, allowing unauthenticated attackers to overwrite the primary administrator's account data (including the email address) and take over that account through the password reset flow.
Articles & Coverage 1
AnalysisAI
Account takeover of the primary WordPress administrator affects the Simple Membership plugin in all versions before 4.7.8. Because the registration routine never checks whether user creation actually succeeded before treating the returned value as a valid user ID, an unauthenticated attacker can trigger a failed user creation and cause the plugin to overwrite the existing admin account's data - notably the email address - then seize the account through the standard password-reset flow. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires that the site has the Simple Membership plugin (before 4.7.8) installed with its front-end member registration flow reachable by anonymous users - the default deployment mode for a membership plugin. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The signals point to a genuinely high-priority issue rather than a paper-tiger high CVSS. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | An unauthenticated attacker submits a crafted registration request designed to make WordPress user creation fail (for example by colliding with an existing username/email), causing the plugin to apply the attacker-supplied profile data to the existing admin account (user ID 1) and overwrite its email address. The attacker then invokes WordPress' lost-password flow, receives the reset link at their controlled email, sets a new password, and logs in as administrator. … |
| Remediation | Upgrade the Simple Membership plugin to version 4.7.8 or later, which is the vendor-released patch and the primary fix. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, inventory all WordPress installations and identify those running Simple Membership plugin versions prior to 4.7.8. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
More in Simple Membership
View allThe Simple Membership WordPress plugin before 4.1.3 allows user to change their membership at the registration stage due
Stored/reflected cross-site scripting in the Simple Membership WordPress plugin before 4.7.5 lets unauthenticated attack
The Simple Membership WordPress plugin before 4.1.3 does not properly validate the membership_level parameter when editi
The Simple Membership plugin before 3.8.5 for WordPress has CSRF affecting the Bulk Operation section. Rated high severi
The Simple Membership WordPress plugin before 4.1.0 does not have CSRF check in place when deleting Transactions, which
Stored cross-site scripting in the Simple Membership WordPress plugin before 4.7.8 allows unauthenticated attackers to i
The Simple Membership WordPress plugin before 4.1.1 does not properly sanitise and escape parameters before outputting t
The Simple Membership WordPress plugin before 4.0.9 does not have CSRF check when deleting members in bulk, which could
Remote attackers without any authentication can bypass authorization checks in the Simple Membership WordPress plugin (v
Broken access control in the WordPress Simple Membership plugin (versions ≤4.7.1) allows remote unauthenticated attacker
The Simple Membership plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and in
The Simple Membership plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the `list_type` parameter
Same weakness CWE-862 – Missing Authorization
View allSame technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today