EUVD-2026-36917
GHSA-x67r-jcr7-mf6r
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
Network-reachable WordPress plugin endpoint with missing authorization (PR:N, AV:N, AC:L, UI:N); broken access control on state-changing action gives high integrity impact, no confidentiality or availability effect.
Primary rating from Vendor (Patchstack).
CVSS VectorVendor: Patchstack
Lifecycle Timeline
1DescriptionCVE.org
Unauthenticated Broken Access Control in Simple Membership <= 4.7.1 versions.
AnalysisAI
Broken access control in the WordPress Simple Membership plugin (versions ≤4.7.1) allows remote unauthenticated attackers to modify protected resources due to missing authorization checks. The flaw, reported by Patchstack and tracked as EUVD-2026-36917, carries a CVSS 3.1 score of 7.5 reflecting high integrity impact with no confidentiality or availability effect. No public exploit identified at time of analysis, but the network-reachable, no-auth profile makes WordPress sites running this plugin a realistic target.
Technical ContextAI
Simple Membership (vendor wp.insider, CPE cpe:2.3:a:wp.insider:simple_membership) is a WordPress plugin that manages member registration, content gating, and subscription levels. The root cause is CWE-862 (Missing Authorization): one or more plugin endpoints/actions process state-changing requests without verifying that the caller is authenticated or holds the required capability. In WordPress plugins this class of bug typically manifests as admin-ajax or REST callbacks lacking current_user_can() / nonce checks, allowing anonymous HTTP callers to invoke privileged logic.
RemediationAI
Upgrade the Simple Membership plugin to a version greater than 4.7.1 as soon as the vendor publishes a fix; the input data does not include a confirmed fix version, so consult the Patchstack advisory (https://patchstack.com/database/wordpress/plugin/simple-membership/vulnerability/wordpress-simple-membership-plugin-4-7-1-broken-access-control-vulnerability) and the NVD entry (https://nvd.nist.gov/vuln/detail/CVE-2026-34886) for the patched release number. Until a patched version is installed, deactivate the Simple Membership plugin if the site can tolerate the loss of membership functionality, or place the affected WordPress site behind a WAF such as Patchstack/Wordfence with a virtual patch for CVE-2026-34886 (trade-off: WAF rules can be bypassed and may block legitimate member workflows). As a narrower compensating control, restrict access to wp-admin/admin-ajax.php and the plugin's REST routes via IP allowlist or HTTP auth where feasible, accepting that this will break public registration and any front-end member actions.
More in Simple Membership
View allThe Simple Membership WordPress plugin before 4.1.3 allows user to change their membership at the registration stage due
Account takeover of the primary WordPress administrator affects the Simple Membership plugin in all versions before 4.7.
Stored/reflected cross-site scripting in the Simple Membership WordPress plugin before 4.7.5 lets unauthenticated attack
The Simple Membership WordPress plugin before 4.1.3 does not properly validate the membership_level parameter when editi
The Simple Membership plugin before 3.8.5 for WordPress has CSRF affecting the Bulk Operation section. Rated high severi
The Simple Membership WordPress plugin before 4.1.0 does not have CSRF check in place when deleting Transactions, which
Stored cross-site scripting in the Simple Membership WordPress plugin before 4.7.8 allows unauthenticated attackers to i
The Simple Membership WordPress plugin before 4.1.1 does not properly sanitise and escape parameters before outputting t
Privilege escalation in the Simple Membership WordPress plugin before 4.7.8 allows authenticated members to obtain highe
The Simple Membership WordPress plugin before 4.0.9 does not have CSRF check when deleting members in bulk, which could
Remote attackers without any authentication can bypass authorization checks in the Simple Membership WordPress plugin (v
The Simple Membership plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and in
Same weakness CWE-862 – Missing Authorization
View allSame technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today