Simple Membership vulnerabilities
We track 3 vulnerabilities in Simple Membership products. 3 are rated high or critical, and none are known to be exploited. The most recent was published on August 3, 2026.
Latest Simple Membership vulnerabilities
- 9.4 Critical severity
Simple Membership: Missing Authorization
The Simple Membership WordPress plugin before 4.7.8 does not verify whether user creation failed during registration before using the returned value as a user ID to update an account, allowing unauthenticated attackers to overwrite the primary administrator's
- 9.8 Critical severity
Simple Membership: Improper Privilege Management
The Simple Membership WordPress plugin before 4.1.3 allows user to change their membership at the registration stage due to insufficient checking of a user supplied parameter.
- 8.8 High severity
Simple Membership: Improper Privilege Management
The Simple Membership WordPress plugin before 4.1.3 does not properly validate the membership_level parameter when editing a profile, allowing members to escalate to a higher membership level by using a crafted POST request.