CVE-2026-15930: Simple Membership < 4.7.8 - Unauthenticated Administrator Account Takeover via Registration Username Collision
Published Aug 3, 2026
·Updated
The Simple Membership WordPress plugin before 4.7.8 does not verify whether user creation failed during registration before using the returned value as a user ID to update an account, allowing unauthenticated attackers to overwrite the primary administrator's account data (including the email address) and take over that account through the password reset flow.
Affected Software
1 affected component
WordPress plugin: Simple Membership<4.7.8
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
wordpress-plugin/simple-membershipto a version that resolves this vulnerability.Fixed in 4.7.8
Event History
Aug 3, 2026
CVE Published
via MITRE·06:00 AM
Data Sourced
via MITRE·06:00 AM
DescriptionWeakness
Data Sourced
via NVD·07:16 AM
DescriptionSeverityWeakness