EUVD-2026-53937
GHSA-526w-8v5p-prpw
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessIdentify WordPress site running Simple Membership ≤ 4.7.8
-
ExploitSend unauthenticated HTTP request to unprotected plugin endpoint
-
ExecutionMissing authorization check bypassed
-
ImpactPerform unauthorized membership or content modification
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A01:2025 - Broken Access Control
ASVS 5.0
V8 - Authorization Authorization checks on every request
MITRE ATT&CK
1 technique across 1 tactic: Privilege Escalation The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | No special conditions are required beyond the plugin being installed and active on a WordPress site - the CVSS vector (PR:N/AC:L/AV:N/UI:N) confirms remote unauthenticated exploitation against default configurations of Simple Membership ≤ 4.7.8. The specific endpoint or feature within the plugin that lacks the authorization check is not identified in the available data; until Patchstack publishes full technical details, the exact attack surface is not narrowed further. Exploitation is limited to write/integrity operations (C:N/I:H/A:N), so attackers cannot directly exfiltrate data or crash the site through this vector alone. |
| Impact | The CVSS 7.5 High rating is well-supported by the vector: network-accessible (AV:N), low complexity (AC:L), no privileges required (PR:N), and no user interaction (UI:N) together describe a fire-and-forget HTTP exploit. The integrity impact is rated High (I:H), indicating meaningful data or access-control manipulation is possible. No EPSS score was provided in the input, limiting probabilistic exploitation forecasting. The vulnerability is not listed in the CISA KEV catalog and no POC has been explicitly confirmed, which moderates urgency somewhat - however, the simplicity of the attack surface (unauthenticated WordPress plugin endpoint) means exploitation barriers are low and weaponization time would be short if a researcher publishes technical details from the Patchstack advisory. For WordPress sites with paying memberships or paywalled content, the business impact of integrity bypass is disproportionately high relative to the raw CVSS score. |
| Exploit ScenarioDerived | An unauthenticated attacker sends a crafted HTTP POST request to the vulnerable Simple Membership plugin endpoint - likely an unprotected AJAX handler or REST route - omitting or forging authorization parameters. The server processes the request without verifying the caller's identity or capability, allowing the attacker to promote a free account to a paid membership tier, bypass paywalled content, or modify membership records. No public exploit code is confirmed, but the low attack complexity means scripted mass exploitation of WordPress instances running this plugin version is feasible shortly after technical disclosure. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Aug 06, 2026
Remote attackers without any authentication can bypass authorization checks in the Simple Membership WordPress plugin (versions ≤ 4.7.8), enabling unauthorized write operations against membership-protected resources. The CVSS vector (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N) confirms exploitation requires no credentials, no user interaction, and low complexity, making this trivially scriptable at scale against any WordPress site running the affected plugin. No public exploit code or CISA KEV listing has been identified at time of analysis, though the Patchstack disclosure provides sufficient detail for independent exploit development.
RemediationAI
Update the Simple Membership plugin to a version beyond 4.7.8 immediately; the exact patched release version is not independently confirmed from the provided data, so administrators should check the WordPress plugin repository or the Patchstack advisory at https://patchstack.com/database/wordpress/plugin/simple-membership/vulnerability/wordpress-simple-membership-plugin-4-7-8-broken-access-control-vulnerability for the confirmed fix version. If an immediate update is not possible, a compensating control is to use a web application firewall rule (such as those offered by Patchstack, Wordfence, or similar) to block unauthenticated requests to suspicious plugin endpoints, though this may impact legitimate plugin functionality. Temporarily deactivating the plugin should be considered for sites where membership content integrity is critical and patching is delayed, accepting the trade-off of losing all membership-gating functionality.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The Simple Membership plugin (vendor: wp.insider, CPE: cpe:2.3:a:wp.insider:simple_membership:*:*:*:*:*:*:*:*) is a WordPress membership management plugin that controls access to protected content based on membership tiers. The root cause is CWE-862 (Missing Authorization): one or more plugin endpoints or AJAX handlers fail to verify that the requesting user is authorized before performing a sensitive action. This class of flaw in WordPress plugins commonly manifests as unprotected admin-side AJAX hooks registered with 'wp_ajax_nopriv_', or REST API endpoints missing capability checks, allowing unauthenticated HTTP requests to trigger privileged operations. The integrity-only impact (C:N/I:H/A:N) suggests the exploitable actions are write-oriented - such as modifying membership status, bypassing paywalls, or altering protected content access - rather than data disclosure.
Know when Simple Membership gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
Network-accessible unauthenticated endpoint with no interaction required; integrity-only impact aligns with access control bypass enabling unauthorized writes.
Primary rating from Vendor (Patchstack).
CVSS VectorVendor: Patchstack
DescriptionCVE.org
Unauthenticated Broken Access Control in Simple Membership <= 4.7.8 versions.
Executive ViewAI
The Simple Membership WordPress plugin (versions ≤ 4.7.8) allows unauthenticated remote attackers to modify membership-protected data without administrator credentials or user interaction, creating direct risk to member record integrity across affected sites. Any WordPress deployment running the plugin is vulnerable regardless of traffic volume or configuration, with no vendor patch currently available. This authorization bypass requires immediate plugin removal or replacement to eliminate the vulnerability.
No vendor-released patch identified at time of analysis. Interim mitigations: Immediately disable the Simple Membership plugin; implement Web Application Firewall rules blocking unauthorized writes to membership endpoints; restrict WordPress administrative access to known IP ranges only; enable database audit logging on membership and user tables to track all write operations; regularly review logs for suspicious activity patterns.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Authentication bypass attacks exploit flaws in the verification mechanisms that control access to systems and applications.
More in Simple Membership
View allThe Simple Membership WordPress plugin before 4.1.3 allows user to change their membership at the registration stage due
Account takeover of the primary WordPress administrator affects the Simple Membership plugin in all versions before 4.7.
Stored/reflected cross-site scripting in the Simple Membership WordPress plugin before 4.7.5 lets unauthenticated attack
The Simple Membership WordPress plugin before 4.1.3 does not properly validate the membership_level parameter when editi
The Simple Membership plugin before 3.8.5 for WordPress has CSRF affecting the Bulk Operation section. Rated high severi
The Simple Membership WordPress plugin before 4.1.0 does not have CSRF check in place when deleting Transactions, which
Stored cross-site scripting in the Simple Membership WordPress plugin before 4.7.8 allows unauthenticated attackers to i
The Simple Membership WordPress plugin before 4.1.1 does not properly sanitise and escape parameters before outputting t
Privilege escalation in the Simple Membership WordPress plugin before 4.7.8 allows authenticated members to obtain highe
Simple Membership, a WordPress membership plugin, transmits a newly registered member's plaintext password in a URL quer
The Simple Membership WordPress plugin before 4.0.9 does not have CSRF check when deleting members in bulk, which could
Unauthenticated attackers can redirect activation and registration-complete emails to an arbitrary address in Simple Mem
Exploit-DB