Kittipat Jitphonchana

**Name of the Vulnerable Software and Affected Versions** Simple Membership versions prior to 4.8.1 **Description** An authentication bypass exists in WordPress Multisite environments during the public registration flow. The issue occurs because the plugin binds new records to existing global WordPress users based only on matching username and email, without requiring password verification or proof of ownership. Additionally, the plugin fails to properly detect Administrator roles on child sites. This allows unauthenticated attackers to take over Administrator accounts on child sites by registering a membership account with a victim's credentials on a site where public registration is enabled and then updating the global WordPress password via the profile edit functionality. **Recommendations** Update to version 4.8.1 or newer.

**Name of the Vulnerable Software and Affected Versions** Forminator plugin for WordPress versions prior to 1.53.0 **Description** An authorization bypass exists because the plugin fails to properly verify user authorization when processing Stripe PaymentIntent identifiers in the public payment flow. This allows unauthenticated attackers to submit high-value paid forms as completed by reusing a previously successful low-value Stripe PaymentIntent, leading to payment bypass or underpayment. **Recommendations** Update the plugin to a version later than 1.52.0.