CVE-2026-77194 in Simple Membership Plugin
Summary
by MITRE • 09/01/2026
The Simple Membership plugin for WordPress is vulnerable to Authentication Bypass leading to Administrator Account Takeover in versions up to, and including, 4.8.0. This is due to improper identity verification during the public registration flow in WordPress Multisite environments, where the plugin binds new Simple Membership records to existing global WordPress users based solely on matching username and email, without requiring password verification or ownership proof, and fails to properly detect Administrator roles on child sites. This makes it possible for unauthenticated attackers to take over Administrator accounts on child sites in a Multisite network by registering a Simple Membership account with a victim's credentials on a site where public registration is enabled, then updating the victim's global WordPress password through the profile edit functionality. The vulnerability was partially patched in version 4.8.1.
If you want to get best quality of vulnerability data, you may have to visit VulDB.
Analysis
by VulDB Data Team • 09/01/2026
The Simple Membership plugin for WordPress contains a critical authentication bypass vulnerability affecting versions up to and including 4.8.0 within WordPress Multisite environments. This flaw stems from improper identity verification during the public registration process, where the system binds new membership records to existing global user accounts based exclusively on matching usernames and email addresses. The security architecture fails to require password verification or any form of ownership proof before linking a new plugin account to an established WordPress user profile. Consequently, this design oversight allows unauthenticated attackers to associate their own Simple Membership credentials with administrative users across the network by simply registering with the victim's known username and email on a site where public registration is enabled.
The operational impact of this vulnerability is severe, as it facilitates complete administrator account takeover in child sites within a Multisite installation. Once an attacker registers using the target user's identity information, they gain access to the profile edit functionality associated with that global WordPress account. Through this interface, the attacker can reset the victim's password without needing prior knowledge of the original credentials or possessing two-factor authentication tokens tied to the initial login event. This effectively grants the attacker full administrative control over any child site where the targeted user holds elevated privileges, leading to potential data exfiltration, malware injection, and further lateral movement within the network infrastructure.
From a classification perspective, this vulnerability aligns with CWE-287 Improper Authentication, as the system fails to adequately verify the identity of users during registration before granting access to sensitive account management features. It also relates to CWE-640 Weak Password Recovery Mechanism for Forgotten Passwords because the ability to reset passwords via profile editing without sufficient proof of ownership undermines the integrity of credential recovery processes. In terms of offensive security frameworks, this attack vector corresponds to MITRE ATT&CK technique T1078 Valid Accounts and specifically leverages T1536 Mitigations Bypass if multi-factor authentication is present but not enforced during the registration binding phase. The vulnerability exploits the trust relationship between the plugin's membership layer and the core WordPress user database, bypassing standard security controls designed to prevent unauthorized account association.
Mitigation strategies must address both immediate remediation and long-term architectural improvements. Administrators should immediately upgrade Simple Membership to version 4.8.1 or later where this specific flaw has been partially patched. However, given that partial patches may not resolve all edge cases in complex Multisite configurations, it is advisable to disable public registration on any site within the network if such functionality is not strictly required for business operations. For environments necessitating open registration, implementing CAPTCHA challenges during signup and requiring email confirmation with a time-limited token can significantly reduce the risk of automated account binding attacks. Additionally, enforcing multi-factor authentication at the WordPress login level provides an additional layer of defense that may mitigate some impacts even if initial credential association occurs. Regular auditing of user roles across child sites is also recommended to detect any unauthorized privilege escalations resulting from this vulnerability before they are exploited for persistent access or data compromise.