WordPress security changelog
MEDIUM CVE-2026-77194 Deferred

Simple Membership permits unauthenticated Multisite Administrator takeover

Simple Membership through 4.8.1 can bind a new membership record to an existing global WordPress user using only a matching username and email, without password or ownership verification, and fails to recognize Administrator roles on child sites. On a Multisite child site with public registration enabled, an unauthenticated attacker can register with an Administrator's identity, use profile editing to replace the victim's global WordPress password, and take over the account. Version 4.8.1 only partially addresses the issue and remains in the affected range.

CVE / CNA score 5.3 CVSS 3.1 · security@wordfence.com
NVD score Pending NVD has not published its own CVSS assessment.
Component
Simple Membership
Plugin slug
simple-membership
Affected
<= 4.8.1
Safe version
See mitigation notes
Published
Sep 01, 2026
Weakness
CWE-287 — Improper Authentication

This CVE was published Sep 01, 2026 and is one of 34 known issues for this plugin.

What to do

Update, patch or deactivate.

Update to a confirmed release newer than 4.8.1 when available. Until then, disable public Simple Membership registration on Multisite child sites when warranted, reset administrator credentials, invalidate sessions, and audit new membership records and password changes.

No confirmed safe version is listed. Consider a vendor-supported patch or temporarily restricting the affected functionality while you assess the risk.

Deactivate only when warranted by your risk profile, or when advised by your hosting provider in the limited circumstances where the vulnerability cannot otherwise be mitigated. If you’re unsure which action is appropriate, contact Fused or your hosting provider for guidance.

Source record

Technical description

The Simple Membership plugin for WordPress is vulnerable to Authentication Bypass leading to Administrator Account Takeover in versions up to, and including, 4.8.0. This is due to improper identity verification during the public registration flow in WordPress Multisite environments, where the plugin binds new Simple Membership records to existing global WordPress users based solely on matching username and email, without requiring password verification or ownership proof, and fails to properly detect Administrator roles on child sites. This makes it possible for unauthenticated attackers to take over Administrator accounts on child sites in a Multisite network by registering a Simple Membership account with a victim's credentials on a site where public registration is enabled, then updating the victim's global WordPress password through the profile edit functionality. The vulnerability was partially patched in version 4.8.1.

CVE / CNA vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N

References

Primary and upstream sources