Simple Membership CVE-2026-34886

No special conditions - remote unauthenticated exploitation against default configurations of the WordPress Simple Membership plugin at version 4.7.1 or earlier, per the CVSS vector AV:N/AC:L/PR:N/UI:N. The only limiting factors are that the target WordPress site must have the Simple Membership plugin installed and active, must be reachable over HTTP(S) from the attacker, and must be running a version ≤4.7.1; no user interaction, authentication, or non-default plugin configuration is required.

The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N) signals a high-priority issue: remote, low-complexity, no authentication, no user interaction, with high integrity impact - a profile that maps cleanly to opportunistic mass exploitation of WordPress plugins. Patchstack confirms the vulnerability class as authentication bypass / broken access control, reinforcing the CVSS read. Mitigating factors: no KEV listing, no EPSS score supplied in the input, and no public exploit identified at time of analysis, so widespread weaponization is not yet confirmed. Given WordPress plugins of this type are routinely scanned and exploited shortly after disclosure, real-world risk should be treated as high despite the lack of in-the-wild signal.

An attacker enumerates WordPress sites running Simple Membership ≤4.7.1 (fingerprintable from plugin assets), then sends crafted unauthenticated HTTP POST requests to the plugin's vulnerable endpoint to invoke a privileged action without the required capability check - for example modifying membership records or subscription state. No public exploit identified at time of analysis, but given AV:N/AC:L/PR:N/UI:N the attack is fully scriptable once the specific endpoint is identified from the patch diff.