EUVD-2026-52175
GHSA-7g75-5pmj-3v8p
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessReach public registration endpoint
-
DeliverySubmit registration that forces user-creation failure
-
ExploitPlugin writes attacker data to admin (ID 1)
-
ExecutionOverwrite admin email address
-
PersistTrigger WordPress password reset
-
ImpactSet new password and log in as admin
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A01:2025 - Broken Access Control
ASVS 5.0
V8 - Authorization Authorization checks on every request
MITRE ATT&CK
1 technique across 1 tactic: Privilege Escalation The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires that the site has the Simple Membership plugin (before 4.7.8) installed with its front-end member registration flow reachable by anonymous users - the default deployment mode for a membership plugin. The attacker must be able to force the user-creation step to fail so the plugin falls through to updating an existing account (e.g., by supplying an already-registered username or email). No authentication, no privileges, and no user interaction are needed (PR:N/UI:N). The main limiting factor is that registration must be enabled and publicly accessible; sites that disable self-registration or gate the registration page behind access controls remove the exposed path. |
| Impact | The signals point to a genuinely high-priority issue rather than a paper-tiger high CVSS. The CVSS vector (AV:N/AC:L/PR:N/UI:N) describes a network-reachable, low-complexity, unauthenticated attack needing no user interaction, and the impact is full administrative account takeover of a WordPress site - the most consequential outcome for a WP install. Publicly available exploit details from WPScan lower the barrier further. The one tempering signal is EPSS: 0.14% at the 4th percentile is low, and there is no CISA KEV listing, so there is no evidence of active or widespread exploitation at time of analysis - the risk is latent and opportunistic rather than confirmed in-the-wild. Note a discrepancy worth flagging: the official CVSS rates confidentiality only Low (C:L), yet a successful admin takeover realistically yields full read access to site data; the provided C:L likely reflects only the direct data-overwrite primitive, not the downstream compromise, so treat effective confidentiality impact as higher than the vector suggests. |
| Exploit ScenarioDerived | An unauthenticated attacker submits a crafted registration request designed to make WordPress user creation fail (for example by colliding with an existing username/email), causing the plugin to apply the attacker-supplied profile data to the existing admin account (user ID 1) and overwrite its email address. The attacker then invokes WordPress' lost-password flow, receives the reset link at their controlled email, sets a new password, and logs in as administrator. Publicly available exploit details from WPScan make this sequence straightforward to reproduce. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Aug 03, 2026
Account takeover of the primary WordPress administrator affects the Simple Membership plugin in all versions before 4.7.8. Because the registration routine never checks whether user creation actually succeeded before treating the returned value as a valid user ID, an unauthenticated attacker can trigger a failed user creation and cause the plugin to overwrite the existing admin account's data - notably the email address - then seize the account through the standard password-reset flow. A vendor patch (4.7.8) and publicly available exploit details from WPScan exist, though EPSS remains low at 0.14% (4th percentile), indicating no measured mass exploitation yet.
RemediationAI
Upgrade the Simple Membership plugin to version 4.7.8 or later, which is the vendor-released patch and the primary fix. Because exploitation targets the front-end registration endpoint, an effective interim mitigation where immediate patching is not possible is to disable member self-registration in the plugin settings (this blocks the vulnerable code path but also stops legitimate signups), or to restrict access to the plugin's registration URL at the web-server/WAF layer to trusted networks only (trade-off: legitimate new members from other networks are blocked). After patching, verify the integrity of the primary administrator account - confirm the admin email address and reset the administrator password - since a prior overwrite would not be undone by the update alone. Reference the WPScan advisory (https://wpscan.com/vulnerability/e46948f1-0e06-4e76-8fc8-df661eb786a5/) for detail.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
Simple Membership is a WordPress membership/paywall plugin that manages front-end user registration and member accounts on top of the native WordPress user system. The root cause maps to CWE-862 (Missing Authorization): during registration the plugin calls WordPress' user-creation API but does not distinguish a WP_Error (failed creation) from a real integer user ID. When creation fails, the falsy/error return value is coerced and used as the target ID for a subsequent account update, which lands on an existing low-numbered account - typically user ID 1, the primary administrator. The update path then writes attacker-controlled fields (including the account email) onto that admin object, and because there is no authorization check binding the update to the requester, an unauthenticated visitor can drive the whole sequence. The CPE (cpe:2.3:a:unknown:simple_membership:*) is unversioned in NVD, but EUVD scopes the flaw to Simple Membership from 0 up to (not including) 4.7.8.
Know when Simple Membership gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:H
Unauthenticated network attack (AV:N/PR:N/UI:N) with low complexity; outcome is full admin takeover, so C/I/A all High rather than the official C:L.
Primary rating from Vendor (WPScan).
CVSS VectorVendor: WPScan
Lifecycle Timeline
4DescriptionCVE.org
The Simple Membership WordPress plugin before 4.7.8 does not verify whether user creation failed during registration before using the returned value as a user ID to update an account, allowing unauthenticated attackers to overwrite the primary administrator's account data (including the email address) and take over that account through the password reset flow.
Articles & Coverage 1
Executive ViewAI
The Simple Membership plugin for WordPress versions below 4.7.8 contains a critical administrator account takeover vulnerability with publicly available exploit code. This allows unauthenticated attackers to seize control of the primary admin account on any affected WordPress installation, enabling complete website compromise including data theft, malware deployment, and operational disruption.
Apply vendor patch.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Authentication bypass attacks exploit flaws in the verification mechanisms that control access to systems and applications.
More in Simple Membership
View allThe Simple Membership WordPress plugin before 4.1.3 allows user to change their membership at the registration stage due
Stored/reflected cross-site scripting in the Simple Membership WordPress plugin before 4.7.5 lets unauthenticated attack
The Simple Membership WordPress plugin before 4.1.3 does not properly validate the membership_level parameter when editi
The Simple Membership plugin before 3.8.5 for WordPress has CSRF affecting the Bulk Operation section. Rated high severi
The Simple Membership WordPress plugin before 4.1.0 does not have CSRF check in place when deleting Transactions, which
Stored cross-site scripting in the Simple Membership WordPress plugin before 4.7.8 allows unauthenticated attackers to i
The Simple Membership WordPress plugin before 4.1.1 does not properly sanitise and escape parameters before outputting t
Privilege escalation in the Simple Membership WordPress plugin before 4.7.8 allows authenticated members to obtain highe
Simple Membership, a WordPress membership plugin, transmits a newly registered member's plaintext password in a URL quer
The Simple Membership WordPress plugin before 4.0.9 does not have CSRF check when deleting members in bulk, which could
Unauthenticated attackers can redirect activation and registration-complete emails to an arbitrary address in Simple Mem
Remote attackers without any authentication can bypass authorization checks in the Simple Membership WordPress plugin (v
Exploit-DB