Executive brief
Simple Membership is a WordPress plugin that manages user registrations and access control. In WordPress Multisite environments, the plugin fails to properly verify user identity during registration, allowing attackers to take over administrator accounts on child sites by registering with a victim's username and email, then changing their password through profile edit functionality.
Technical details
The vulnerability is an authentication bypass resulting from improper identity verification during public registration in WordPress Multisite environments. The plugin binds new Simple Membership records to existing global WordPress users based solely on matching username and email, without requiring password verification or ownership proof, and fails to properly detect Administrator roles on child sites. An unauthenticated attacker can exploit this by registering a Simple Membership account using a victim's credentials on a site with public registration enabled, then updating the victim's global WordPress password through the profile edit functionality. This grants the attacker administrator access on the victim's child site. The vulnerability was partially patched in version 4.8.1.
Affected products
- WordPress Simple Membership up to and including 4.8.0
Timeline
- 2026-09-01: disclosed
- 2026: patched: Partial patch in version 4.8.1