CVE-2026-97337: Simple Membership <= 4.8.3 - Missing Authorization to Unauthenticated Account Takeover and Sensitive Information Disclosure via 'email' Parameter on Activation Endpoints
The Simple Membership plugin for WordPress is vulnerable to unauthorized modification of data and sensitive information disclosure in versions up to, and including, 4.8.3 via the resend-activation and email-activation endpoints. The endpoints are dispatched from SwpmInitTimeTasks::checkanddoemailactivation() on frontend init with no authentication, nonce, capability, or ownership check, and the recipient address used by SwpmRegistration::sendregemail() is taken from an attacker-controlled $POST['email'] parameter (overriding the member's registered address). This makes it possible for unauthenticated attackers to redirect an arbitrary pending member's activation email — and the follow-up 'registration complete' email containing the member's username and plaintext password — to an attacker-chosen address, and to then activate that member's account without their consent.
Affected Software
Event History
Frequently Asked Questions
Who is exposed to account takeover through this issue?
Sites using Simple Membership version 4.8.3 or earlier are exposed for member accounts that are pending activation. An unauthenticated remote attacker can target those accounts.
What does an attacker need to exploit it?
No authentication, nonce, capability, ownership check, or user interaction is required. The attacker can submit an attacker-controlled email address to the resend-activation or email-activation functionality.
What information can be disclosed?
The attacker can redirect the pending member's activation email and the subsequent registration-complete email to an address they control. The registration-complete email contains the member's username and plaintext password.
How can an attacker take over the targeted account?
After redirecting the activation email, the attacker can activate the pending member account without the member's consent. The redirected registration-complete email provides the account credentials.