Simple Membership CVE-2026-42663

The target site must be running the Simple Membership WordPress plugin in version 4.7.2 or earlier. A critical ambiguity exists: the CVE description states exploitation is unauthenticated (no WordPress account required), but the CVSS PR:L metric indicates a low-privilege account (e.g., WordPress subscriber role) is required to inject the payload - security teams must verify with Patchstack or the plugin vendor before assessing the true barrier to entry. Successful exploitation additionally requires that a privileged user (most likely a WordPress administrator) interacts with the attacker-influenced content (UI:R), meaning the attacker cannot directly trigger impact and must induce victim interaction. The scope change (S:C) implies the injection point and execution context are separate - the plugin must expose attacker-controlled data in an admin-facing view or privileged user context. No specific non-default plugin configuration is described as required.

The official CVSS score of 6.5 with vector AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L places this as a medium-severity issue with real but bounded impact. CRITICAL CONFLICT: The CVE description labels this 'Unauthenticated' XSS, yet the CVSS assigns PR:L (low privileges required) - these are mutually exclusive. If PR:N applies (truly unauthenticated), the effective score rises and the attack surface broadens considerably, as no WordPress account would be needed. If PR:L is correct, a subscriber-level account would be required to inject payloads. Security teams should NOT assume either until Patchstack or the vendor clarifies. The Scope:Changed (S:C) metric elevates real-world risk: a successful XSS against an administrator session in WordPress can lead to complete site takeover through administrative functions. No EPSS data was provided in the source intelligence. No CISA KEV listing exists, and no POC has been identified, suggesting opportunistic rather than targeted exploitation currently. The A:L (availability impact) metric is atypical for XSS and may indicate the payload can disrupt page rendering or certain plugin functions - this warrants verification.

An attacker - either unauthenticated or holding a low-privilege WordPress subscriber account (pending clarification of the PR conflict) - submits a crafted input containing a malicious JavaScript payload through a Simple Membership plugin form or parameter, such as a registration field or member profile attribute. The unsanitized payload is stored or reflected and later rendered in a WordPress administrator's browser when reviewing member data or processing membership requests. The executing script silently exfiltrates the administrator's session cookie or submits a forged administrative request, granting the attacker full control of the WordPress site. No public POC has been identified, but the attack technique is well-understood and requires no specialized tooling.