EUVD-2026-69022
GHSA-w48h-3prc-xgxg
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
Unauthenticated network attack yields Administrator account takeover and global password change, crossing scope boundary from child site to the shared WordPress Multisite user database.
Primary rating from Vendor (Wordfence).
CVSS VectorVendor: Wordfence
Lifecycle Timeline
2DescriptionCVE.org
The Simple Membership plugin for WordPress is vulnerable to Authentication Bypass leading to Administrator Account Takeover in versions up to, and including, 4.8.0. This is due to improper identity verification during the public registration flow in WordPress Multisite environments, where the plugin binds new Simple Membership records to existing global WordPress users based solely on matching username and email, without requiring password verification or ownership proof, and fails to properly detect Administrator roles on child sites. This makes it possible for unauthenticated attackers to take over Administrator accounts on child sites in a Multisite network by registering a Simple Membership account with a victim's credentials on a site where public registration is enabled, then updating the victim's global WordPress password through the profile edit functionality. The vulnerability was partially patched in version 4.8.1.
AnalysisAI
Administrator account takeover in the Simple Membership plugin for WordPress (versions up to and including 4.8.0) is achievable by unauthenticated remote attackers targeting WordPress Multisite networks with public registration enabled. The plugin's registration flow binds new membership records to existing global WordPress users using only username and email matching - no password or ownership proof - and fails to detect Administrator roles on child sites, allowing attackers to subsequently overwrite the victim's global WordPress password via the profile-edit feature. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Three conditions must co-occur for exploitation: (1) the WordPress installation must be running in Multisite mode - standard single-site WordPress deployments are not affected; (2) public registration must be enabled on at least one child site where the Simple Membership plugin is active and publicly accessible; and (3) the attacker must know both the username and the email address of a target Administrator account on a child site, since the attack pivot relies on matching these two fields exactly. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The NVD-assigned CVSS score of 5.3 (S:U/C:N/I:L/A:N) critically misrepresents the actual impact: the described outcome is full Administrator account takeover with password replacement, an impact that warrants C:H/I:H/A:H metrics and a score in the 9.x range - this discrepancy should be verified against the NVD record and vendor advisory before prioritization decisions are made. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Upgrade Simple Membership to version 4.8.1 as the primary fix, but note the vendor explicitly describes this as a partial patch - administrators should monitor the plugin's changelog and the Wordfence advisory for a complete remediation release. … Detailed patch versions, workarounds, and compensating controls in full report. |
Threat intelligence, references, and detailed analysis are available after sign-in.
More in Simple Membership
View allThe Simple Membership WordPress plugin before 4.1.3 allows user to change their membership at the registration stage due
Account takeover of the primary WordPress administrator affects the Simple Membership plugin in all versions before 4.7.
Stored/reflected cross-site scripting in the Simple Membership WordPress plugin before 4.7.5 lets unauthenticated attack
The Simple Membership WordPress plugin before 4.1.3 does not properly validate the membership_level parameter when editi
The Simple Membership plugin before 3.8.5 for WordPress has CSRF affecting the Bulk Operation section. Rated high severi
The Simple Membership WordPress plugin before 4.1.0 does not have CSRF check in place when deleting Transactions, which
Stored cross-site scripting in the Simple Membership WordPress plugin before 4.7.8 allows unauthenticated attackers to i
The Simple Membership WordPress plugin before 4.1.1 does not properly sanitise and escape parameters before outputting t
Privilege escalation in the Simple Membership WordPress plugin before 4.7.8 allows authenticated members to obtain highe
The Simple Membership WordPress plugin before 4.0.9 does not have CSRF check when deleting members in bulk, which could
Remote attackers without any authentication can bypass authorization checks in the Simple Membership WordPress plugin (v
Broken access control in the WordPress Simple Membership plugin (versions ≤4.7.1) allows remote unauthenticated attacker
Same weakness CWE-287 – Improper Authentication
View allSame technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today