Simple Membership CVE-2026-77194

Three conditions must co-occur for exploitation: (1) the WordPress installation must be running in Multisite mode - standard single-site WordPress deployments are not affected; (2) public registration must be enabled on at least one child site where the Simple Membership plugin is active and publicly accessible; and (3) the attacker must know both the username and the email address of a target Administrator account on a child site, since the attack pivot relies on matching these two fields exactly. The CVSS vector (PR:N/UI:N) confirms that no authentication or user interaction is required at the time of exploitation. The main factors limiting exploitation are the Multisite deployment requirement and the need to discover or guess a valid administrator's username/email pair - accounts using non-public or obfuscated email addresses present higher discovery friction, though WordPress author slugs frequently leak usernames.

The NVD-assigned CVSS score of 5.3 (S:U/C:N/I:L/A:N) critically misrepresents the actual impact: the described outcome is full Administrator account takeover with password replacement, an impact that warrants C:H/I:H/A:H metrics and a score in the 9.x range - this discrepancy should be verified against the NVD record and vendor advisory before prioritization decisions are made. No EPSS score was provided in the available intelligence, and no CISA KEV listing or confirmed public POC exists at time of analysis, so mass opportunistic exploitation has not been established. Despite these absent signals, the attack mechanics are accessible to unsophisticated actors: the only prerequisites are knowledge of a victim administrator's username and email, which WordPress frequently exposes through author archive slugs, contributor profiles, or support forum posts. The vulnerability is structurally constrained to WordPress Multisite deployments with public registration enabled, which meaningfully reduces the exposed population - yet even a mid-sized municipal IT team in inowroclaw running a community-facing Multisite installation would face real risk if any child site allows open registration. The vendor's own characterization of 4.8.1 as a 'partial' patch, backed by two separate changesets (3668897 and 3673368), introduces remediation uncertainty: operators cannot assume the fix is complete and must monitor for a follow-up release.

An attacker targeting a WordPress Multisite network discovers an Administrator's username and email through the WordPress author archive or a public contributor page. The attacker navigates to any child site with public registration enabled, submits the Simple Membership registration form using the administrator's exact username and email, and the plugin silently binds the new membership record to the existing Administrator account without any password check. The attacker then uses the profile-edit functionality to set a new password on the globally shared WordPress account, locks out the legitimate administrator, and gains full administrative access to the child site - and potentially the entire Multisite network. No public exploit code has been confirmed at time of analysis.