Description

The Simple Membership plugin for WordPress is vulnerable to Authentication Bypass leading to Administrator Account Takeover in versions up to, and including, 4.8.0. This is due to improper identity verification during the public registration flow in WordPress Multisite environments, where the plugin binds new Simple Membership records to existing global WordPress users based solely on matching username and email, without requiring password verification or ownership proof, and fails to properly detect Administrator roles on child sites. This makes it possible for unauthenticated attackers to take over Administrator accounts on child sites in a Multisite network by registering a Simple Membership account with a victim's credentials on a site where public registration is enabled, then updating the victim's global WordPress password through the profile edit functionality. The vulnerability was partially patched in version 4.8.1.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "5.3",
  "pubDate": "2026-09-01T12:17:47.737Z",
  "pubdate": "2026-09-01T12:17:47.737Z",
  "executiveSummary": "The Simple Membership plugin for WordPress, in versions up to and including 4.8.0, is affected by an authentication bypass vulnerability that facilitates complete Administrator account takeover within WordPress Multisite environments.\nThis vulnerability stems from a flaw in the identity verification logic during the public registration process. By design, the plugin erroneously associates new membership records with existing global WordPress users based exclusively on matching username and email address parameters, bypassing the necessity for password authentication or ownership verification.\nFurthermore, the plugin fails to perform adequate role-based access control (RBAC) checks when binding these accounts, specifically failing to sanitize or restrict the binding of administrative privileges on child sites.\nAn unauthenticated attacker can leverage this logic to register a membership record using a victim's known credentials. Upon successful registration, the attacker gains the ability to manipulate the victim's profile via the plugin's profile edit functionality, allowing for a password reset that propagates to the global WordPress user account.\nThis represents a critical security risk, granting unauthorized full administrative access to targeted sites within a network. The vulnerability remains effective in scenarios where public registration is enabled, requiring no prior authentication from the attacker.",
  "technicalDetails": "The root cause of the vulnerability lies in the insecure design of the identity verification flow within the Simple Membership plugin's registration handler. When processing new registrations in a WordPress Multisite environment, the plugin executes a lookup function to match user identifiers against the global wp_users table.\nInstead of employing cryptographic proof of ownership—such as existing password verification or email-based token authentication—the plugin relies on a loose matching logic involving the 'user_login' and 'user_email' fields. This mechanism establishes a bridge between the Simple Membership plugin's user database and the core WordPress authentication system without enforcing authorization boundaries.\nThe vulnerability is compounded by the plugin's failure to audit the role of the user being targeted. In a Multisite context, where administrative roles are managed at the site level, the plugin incorrectly assumes that binding to an existing account is a benign operation. Because the application logic does not distinguish between standard users and those with high-privilege 'Administrator' roles on specific child sites, the plugin permits the creation of an authentication context that can influence the higher-privileged account.\nThe attack flow begins when an attacker performs a registration on a child site where the registration feature is publicly exposed. The attacker inputs the username and email of a target administrative user. The plugin detects these matching credentials in the global database and links the new Simple Membership entry to the victim's global account.\nOnce the association is established, the attacker utilizes the plugin's 'profile edit' functionality. Because the plugin effectively treats the attacker as the owner of the session, it allows for the submission of account updates, including the modification of the 'user_pass' field. Due to the lack of sufficient verification checks, this update is committed to the global WordPress user object via core functions, resulting in the victim’s password being overwritten by the attacker.\nPost-exploitation, the attacker possesses the ability to authenticate as the Administrator of the child site. This provides full administrative control over the site’s configuration, data, and plugin ecosystem, potentially allowing for remote code execution via theme or plugin uploads or persistent cross-site scripting (XSS) injection. The impact is essentially total site compromise."
}