← Back to the live CVE advisory feed

CVE-2026-97337: Simple Membership

Severity

7.5 (HIGH)

Vendor

WPINSIDER-1

Affected versions

0 through 4.8.3

Patch status

Unknown

Published

2026-10-03T06:16:48.943

Modified

2026-10-03T16:16:48.693

Why it matters

This matters because the affected product may be exposed on public websites. A vulnerable plugin can create a direct path to site compromise, malicious code deployment, or data theft.

Recommended admin actions

• Review and patch based on exposure, asset criticality, and business impact.
• Check whether the affected WordPress plugin or theme is installed.
• Update, disable, or remove the affected component if present.
• Treat internet-facing systems as higher priority.

Technical summary

The Simple Membership plugin for WordPress is vulnerable to unauthorized modification of data and sensitive information disclosure in versions up to, and including, 4.8.3 via the resend-activation and email-activation endpoints. The endpoints are dispatched from SwpmInitTimeTasks::check_and_do_email_activation() on frontend init with no authentication, nonce, capability, or ownership check, and the recipient address used by SwpmRegistration::send_reg_email() is taken from an attacker-controlled $_POST['email'] parameter (overriding the member's registered address). This makes it possible for unauthenticated attackers to redirect an arbitrary pending member's activation email — and the follow-up 'registration complete' email containing the member's username and plaintext password — to an attacker-chosen address, and to then activate that member's account without their consent.

View the official NVD record for CVE-2026-97337

CVE data is sourced from NVD/CNA records and optional enrichment. Validate against the vendor advisory before taking production action.