Is CVE-2026-66712 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-66712 being exploited in the wild.

How severe is CVE-2026-66712?

High severity, with a CVSS score of 7.5, published 6 August 2026.

Which products and versions are affected?

Simple Membership Simple Membership <=4.7.8.

Is there a fix for CVE-2026-66712?

A patch was published on 2026-08-05: Fixed in version 4.7.9 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-66712 attacked?

It is attacked over the network.

Am I affected by CVE-2026-66712?

Check whether anything you run is named in the advisory. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-66712: Simple Membership broken access control in page access

Q: Is there a fix for CVE-2026-66712?

A patch was published on 2026-08-05: Fixed in version 4.7.9 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

Q: How is CVE-2026-66712 attacked?

It is attacked over the network.

Q: Am I affected by CVE-2026-66712?

Check whether anything you run is named in the advisory. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-66712 · Severity: high · CVSS 7.5 · Published 2026-08-06

Simple Membership is a WordPress plugin that manages user registration and content access control for membership sites. An unauthenticated attacker can bypass access restrictions and view or interact with protected pages and functionality they should not be permitted to access, potentially exposing private member data or allowing unauthorized actions.

Quick answers

Is CVE-2026-66712 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-66712 being exploited in the wild.
How severe is CVE-2026-66712?: High severity, with a CVSS score of 7.5, published 6 August 2026.
Which products and versions are affected?: Simple Membership Simple Membership <=4.7.8.
Is there a fix for CVE-2026-66712?: A patch was published on 2026-08-05: Fixed in version 4.7.9 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-66712 attacked?: It is attacked over the network.
Am I affected by CVE-2026-66712?: Check whether anything you run is named in the advisory. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

Simple Membership plugin versions 4.7.8 and earlier contain a broken access control vulnerability that allows unauthenticated users to bypass authorization checks on protected pages. The vulnerability is reachable over the network without authentication or user interaction required. An attacker can exploit this to access restricted content, view other members' data, or perform actions intended only for authenticated users with proper permissions. The vulnerability was patched in version 4.7.9, and administrators should update immediately.

Affected products

Simple Membership Simple Membership <=4.7.8

Timeline

2026-08-05: disclosed: Vulnerability reported and disclosed
2026-08-05: patched: Fixed in version 4.7.9

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.