# CVE-2026-97337: Simple Membership WordPress plugin unauthorized account activation and credential disclosure

Source: https://junglewise.ai/threats/cve-2026-97337-the-simple-membership-plugin-for-wordpress-is-vulnerable-to  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-10-03. Updated: 2026-10-05  
License: CC BY 4.0 with a link back

CVE-2026-97337 · Severity: high · CVSS 7.5 · Published 2026-10-03

Simple Membership is a WordPress plugin that manages user registrations and memberships. An unauthenticated attacker can redirect activation emails and plaintext passwords to an attacker-controlled email address, then activate accounts without the user's consent. This allows account takeover and unauthorized access to member accounts.

Vendors: [WordPress.org](https://junglewise.ai/threats/vendors/wordpress-org).

## Quick answers

**Is CVE-2026-97337 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-97337 being exploited in the wild.

**How severe is CVE-2026-97337?** High severity, with a CVSS score of 7.5, published 3 October 2026.

**Which products and versions are affected?** WordPress.org Simple Membership up to and including 4.8.3.

**Is there a fix for CVE-2026-97337?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2026-97337 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2026-97337?** Check whether you run WordPress.org Simple Membership at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

The plugin's resend-activation and email-activation endpoints lack authentication, nonce validation, and ownership checks, allowing unauthenticated access during frontend initialization. The vulnerability stems from use of an attacker-controlled $_POST['email'] parameter in SwpmRegistration::send_reg_email() to override the member's registered email address. An attacker can intercept activation and welcome emails containing usernames and plaintext passwords, then activate accounts without consent.

## Affected products

- WordPress.org Simple Membership up to and including 4.8.3

## Timeline

- 2026-10-03: disclosed

## References

- [https://plugins.trac.wordpress.org/browser/simple-membership/tags/4.8.3/classes/class.swpm-front-registration.php](https://plugins.trac.wordpress.org/browser/simple-membership/tags/4.8.3/classes/class.swpm-front-registration.php)
- [https://plugins.trac.wordpress.org/browser/simple-membership/tags/4.8.3/classes/class.swpm-front-registration.php](https://plugins.trac.wordpress.org/browser/simple-membership/tags/4.8.3/classes/class.swpm-front-registration.php)

## Related threats

- [Simple Membership plugin stored XSS in country parameter](https://junglewise.ai/threats/cve-2026-103427-the-simple-membership-plugin-for-wordpress-is-vulnerable-to)