TI-2022-02140 Aliases CVE-2022-2317 GHSA-r2wm-jmvh-5q98

Simple Membership < 4.1.3 - Unauthenticated Membership Privilege Escalation

MEDIUM 45CWE-269Published 2022-08-01 · Updated 2024-08-03

Key facts

Attack vector: Network
Privileges required: None
User interaction: None
Attack complexity: Low
Impact type: Privilege escalation
Confidentiality · integrity · availability: High · High · High
Fix status: Fixed

Attack profile from CVSS 3.1 · NVD. Fix status from CNA. Impact type from CWE-269.

Summary

The Simple Membership WordPress plugin before 4.1.3 allows user to change their membership at the registration stage due to insufficient checking of a user supplied parameter.

Why it matters now

EPSS 0.01393 72nd percentileScored 2026-11-07

Public exploit Yes 1 exploit referenceTagged by NVD

Fix Fixed Simple Membership (Unknown): 4.1.3

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
Unknown	Simple Membership	4.1.3 to before 4.1.3	4.1.3	Patch available	CNA

Simple Membership VendorUnknown Affected 4.1.3 to before 4.1.3 Fixed in 4.1.3 Patch available CNA

CPE configurations NVD · 1

CPE	Versions	Role	Vendor
cpe:2.3:a:simple-membership-plugin:simple_membership::::::wordpress::*	before 4.1.3	Vulnerable	wpinsider-1

cpe:2.3:a:simple-membership-plugin:simple_membership:*:*:*:*:*:wordpress:*:* Versions before 4.1.3 Vulnerable ·wpinsider-1

Remediation

Fix · CNA Simple Membership (Unknown) Fixed in 4.1.3

Fixed in the same release

Records fixed by the same vendor advisory or release, as the CNA lists them.

Release · 2022-08-01
Simple Membership 4.1.3
2 records Highest priority Priority MEDIUM 2 MEDIUM
Other records, highest priority first
- TI-2022-02098 Simple Membership < 4.1.3 - Membership Privilege EscalationPriority MEDIUM 40
Show all 2 records →

Timeline

2026-10-02 Threatist record created from CVE-2022-2317
2026-10-03 Alias added: GHSA-r2wm-jmvh-5q98

References

Exploit 1

https://wpscan.com/vulnerability/77b7ca19-294c-4480-8f57-6fddfc67fffb

TI-2022-04084 Simple Membership < 4.2.2 - Contributor+ Stored XSS CVSS 3.1MEDIUM 5.4
TI-2023-22342 WordPress Simple Membership plugin <= 4.3.4 - Unauthenticated Membership Role Privilege Escalation vulnerability CVSS 3.1CRITICAL 9.8
TI-2019-10675 The Simple Membership plugin before 3.8.5 for WordPress has CSRF affecting the Bulk Operation section. CVSS 3.0HIGH 8.8
TI-2023-22341 WordPress Simple Membership plugin <= 4.3.4 - Authenticated Account Takeover vulnerability CVSS 3.1HIGH 8.8
TI-2024-10273 Simple Membership <= 4.5.5 - Exposure of Private Personal Information to an Unauthorized Actor CVSS 3.1HIGH 7.5
TI-2022-02098 Simple Membership < 4.1.3 - Membership Privilege Escalation CVSS 3.1HIGH 8.8

See all 19 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences