CVE-2026-15930
CriticalCVSS 9.4Exploitation Probability (EPSS)
Low risk4th percentile - higher than 4% of all known CVEs
Summary
The Simple Membership WordPress plugin before version 4.7.8 does not verify whether user creation failed during registration before using the returned value as a user ID to update an account. This allows unauthenticated attackers to overwrite the primary administrator's account data (including the email address) and take over that account through the password reset flow.
Risk Assessment
An attacker can take over the administrator account, gaining full control of the site, which can lead to data theft and content modification.
Recommendation
Update the Simple Membership plugin to version 4.7.8 or later, which verifies successful registration before updating accounts.
Original NVD description (English source)
The Simple Membership WordPress plugin before 4.7.8 does not verify whether user creation failed during registration before using the returned value as a user ID to update an account, allowing unauthenticated attackers to overwrite the primary administrator's account data (including the email address) and take over that account through the password reset flow.