Simple Membership EUVD-2026-91908

Exploitable only against Simple Membership installations (≤4.8.3) that have pending, not-yet-activated member accounts, because the attack hijacks the activation/resend-activation flow; sites with no pending registrations have no exploitable target. The resend-activation and email-activation endpoints are dispatched on frontend init with no authentication, nonce, capability, or ownership check, and the recipient is taken verbatim from the attacker-supplied $_POST['email'] parameter, so no credentials or user interaction from the victim are required. The practical limiter is knowledge of a valid pending member's identifier/email and the time window before that member activates their own account; confidentiality impact (plaintext password/username disclosure) occurs only if the follow-up 'registration complete' email is successfully redirected.

The signals align toward a genuine, prioritizable access-control flaw but short of emergency status. The input CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N, 7.5) is consistent with the description: a network-reachable, low-complexity, unauthenticated endpoint (resend-activation / email-activation) dispatched from SwpmInitTimeTasks::check_and_do_email_activation() on frontend init with no authentication, nonce, capability, or ownership check (CWE-862, Missing Authorization). The C:H rating is well supported - the redirected 'registration complete' email leaks the member's username and plaintext password to an attacker-chosen address. However, the input vector's I:N understates the integrity impact: the description explicitly states the attacker can activate a pending member's account without consent and perform 'unauthorized modification of data,' which is an integrity effect - verify this discrepancy with Wordfence/NVD, as I:N appears inconsistent with the narrative. No EPSS score, KEV listing, or POC indicator was supplied; absence of these is not evidence of safety but means there is no public exploit identified at time of analysis and no confirmation of active exploitation. Net: a real priority for any site running the plugin because exploitation is trivial and unauthenticated, but it is NOT in the emergency tier reserved for KEV/confirmed-exploited issues. Exploitation also depends on the existence of pending (not-yet-activated) member accounts, which limits the realistic attack surface.

An unauthenticated attacker identifies or guesses an email/username tied to a pending Simple Membership registration and sends a crafted POST request to the resend-activation (or email-activation) endpoint with a $_POST['email'] value they control. The plugin, lacking any authentication, nonce, capability, or ownership check, sends the activation and follow-up 'registration complete' email - containing the member's username and plaintext password - to the attacker's address, after which the attacker activates and takes over the account. No public exploit code was identified at time of analysis, but the attack is trivial to script given low complexity and no authentication.