Improper authentication in wpinsider-1 Simple Membership
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- None
- Attack complexity
- Low
- Impact type
- Security bypass
- Confidentiality · integrity · availability
- None · Low · None
- Fix status
- No fix listed
Attack profile from CVSS 3.1 · CNA. Fix status from CNA. Impact type from CWE-287.
Summary
The Simple Membership plugin for WordPress is vulnerable to Authentication Bypass leading to Administrator Account Takeover in versions up to, and including, 4.8.0. This is due to improper identity verification during the public registration flow in WordPress Multisite environments, where the plugin binds new Simple Membership records to existing global WordPress users based solely on matching username and email, without requiring password verification or ownership proof, and fails to properly detect Administrator roles on child sites. This makes it possible for unauthenticated attackers to take over Administrator accounts on child sites in a Multisite network by registering a Simple Membership account with a victim's credentials on a site where public registration is enabled, then updating the victim's global WordPress password through the profile edit functionality. The vulnerability was partially patched in version 4.8.1.
Why it matters now
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- Yes
- Technical impact
- Partial
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| wpinsider-1 | Simple Membership | up to 4.8.1 | — | No fix listed | CNA |
- Simple Membership Vendorwpinsider-1 Affected up to 4.8.1 Fixed in — No fix listed CNA
CPE names Threatist (inferred) · 1
Inferred from how NVD named this product before; not given by a source.
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:simple-membership-plugin:simple_membership:*:*:*:*:*:*:*:* | — | — | wpinsider-1 |
- cpe:2.3:a:simple-membership-plugin:simple_membership:*:*:*:*:*:*:*:* Versions — — ·wpinsider-1
Remediation
No fixed version listed by the sources yet.
Timeline
- 2026-10-02 Threatist record created from CVE-2026-77194
- 2026-10-03 Alias added: GHSA-w48h-3prc-xgxg
References
Other 8
- https://www.wordfence.com/threat-intel/vulnerabilities/id/ccd3eae5-3d30-4d0d-8f95-5f0747e4e944?source=cve
- https://plugins.trac.wordpress.org/browser/simple-membership/tags/4.8.0/classes/class.swpm-utils.php#L329
- https://plugins.trac.wordpress.org/browser/simple-membership/tags/4.8.0/classes/class.swpm-utils-member.php#L461
- https://plugins.trac.wordpress.org/browser/simple-membership/tags/4.8.0/classes/class.swpm-utils.php#L365
- https://plugins.trac.wordpress.org/browser/simple-membership/tags/4.8.0/classes/class.swpm-front-registration.php#L126
- https://plugins.trac.wordpress.org/browser/simple-membership/tags/4.8.0/classes/class.swpm-form.php#L214
- https://plugins.trac.wordpress.org/changeset/3668897/
- https://plugins.trac.wordpress.org/changeset/3673368/
More wpinsider-1 vulnerabilities
- TI-2022-04084 Simple Membership < 4.2.2 - Contributor+ Stored XSS CVSS 3.1MEDIUM 5.4
- TI-2023-22342 WordPress Simple Membership plugin <= 4.3.4 - Unauthenticated Membership Role Privilege Escalation vulnerability CVSS 3.1CRITICAL 9.8
- TI-2022-02140 Simple Membership < 4.1.3 - Unauthenticated Membership Privilege Escalation CVSS 3.1CRITICAL 9.8
- TI-2019-10675 The Simple Membership plugin before 3.8.5 for WordPress has CSRF affecting the Bulk Operation section. CVSS 3.0HIGH 8.8
- TI-2023-22341 WordPress Simple Membership plugin <= 4.3.4 - Authenticated Account Takeover vulnerability CVSS 3.1HIGH 8.8
- TI-2024-10273 Simple Membership <= 4.5.5 - Exposure of Private Personal Information to an Unauthorized Actor CVSS 3.1HIGH 7.5
Sources
- CVE-2026-77194 · CVE Program
- CVE-2026-77194 · NVD
- FIRST EPSS
- GHSA-w48h-3prc-xgxg · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences