CVE-2026-77194

Name of the Vulnerable Software and Affected Versions Simple Membership versions prior to 4.8.1

Description An authentication bypass exists in WordPress Multisite environments during the public registration flow. The issue occurs because the plugin binds new records to existing global WordPress users based only on matching username and email, without requiring password verification or proof of ownership. Additionally, the plugin fails to properly detect Administrator roles on child sites. This allows unauthenticated attackers to take over Administrator accounts on child sites by registering a membership account with a victim's credentials on a site where public registration is enabled and then updating the global WordPress password via the profile edit functionality.

Recommendations Update to version 4.8.1 or newer.