CVE-2026-15930
Simple Membership < 4.7.8 - Unauthenticated Administrator Account Takeover via Registration Username Collision
CVSS Score
0.0
EPSS Score
0.0%
EPSS Percentile
0th
The Simple Membership WordPress plugin before 4.7.8 does not verify whether user creation failed during registration before using the returned value as a user ID to update an account, allowing unauthenticated attackers to overwrite the primary administrator's account data (including the email address) and take over that account through the password reset flow.
| Vendor | unknown |
| Product | simple membership |
| Published | Aug 3, 2026 |
Stay Ahead of the Next One
Get instant alerts for unknown simple membership
Be the first to know when new unknown vulnerabilities affecting unknown simple membership are published — delivered to Slack, Telegram or Discord.
Get Free Alerts →
Free · No credit card · 60 sec setup
Affected Versions
Unknown / Simple Membership
0 < 4.7.8
References
Credits
Brandon Steed WPScan