CVE-2026-15930
Simple Membership < 4.7.8 - Unauthenticated Administrator Account Takeover via Registration Username Collision
CRITICAL 9.4EPSS 0.4%
The Simple Membership WordPress plugin before 4.7.8 does not verify whether user creation failed during registration before using the returned value as a user ID to update an account, allowing unauthenticated attackers to overwrite the primary administrator's account data (including the email address) and take over that account through the password reset flow.
- Affected
- Simple Membership
- CVSS v3.1 CNA
- 9.4 CRITICAL
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:H - EPSS
- 0.42% chance of exploitation in the next 30 days, 35th percentile
- Published
- 2026-08-03