CVE-2026-74000: WordPress Simple Membership plugin <= 4.8.2 - Broken Access Control vulnerability
Published Sep 17, 2026
·Updated
Contributor Broken Access Control in Simple Membership <= 4.8.2 versions.
Affected Software
1 affected component
WordPress Simple Membership plugin<=4.8.2
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
WordPress Simple Membership pluginto a version that resolves this vulnerability.Fixed in 4.8.3
Event History
Sep 17, 2026
CVE Published
via MITRE·01:24 PM
Data Sourced
via MITRE·01:24 PM
RemedyDescriptionSeverityWeakness
Frequently Asked Questions
1
Which users are affected by this issue?
The issue affects sites using the WordPress Simple Membership plugin at version 4.8.2 or earlier. The reported access-control weakness involves Contributor-level access.
2
Does exploiting this require authentication or user interaction?
The supplied CVSS vector indicates no privileges and no user interaction are required. It is remotely exploitable over the network with low attack complexity.
3
What is the expected impact?
The reported impact is limited to integrity, with no stated confidentiality or availability impact. The CVSS base score is 5.3 (medium).