CVE-2026-19224

The Hummingbird Performance WordPress plugin, in versions before 3.21.2 , contains a vulnerability where network-wide settings are not restricted to network administrators. This flaw allows an administrator of any single site on a multisite network to execute arbitrary code across the entire netw...

CVE-2026-19224 Hummingbird < 3.21.2 - Admin+ Network-Wide RCE via Hub Connector on Multisite

The Hummingbird Performance WordPress plugin before 3.21.2 does not restrict a network-wide setting to network administrators, allowing an administrator of any single site on a multisite network to execute arbitrary code across the entire network...

CVE-2026-19224: Improper Control of Generation of Code

The Hummingbird Performance WordPress plugin before 3.21.2 does not restrict a network-wide setting to network administrators, allowing an administrator of any single site on a multisite network to execute arbitrary code across the entire network...

PT-2026-85408

The Hummingbird Performance WordPress plugin before 3.21.2 does not restrict a network-wide setting to network administrators, allowing an administrator of any single site on a multisite network to execute arbitrary code across the entire network...

WordPress theme My Login plugin 7.0-7.1.15 - Subscriber+ Unauthorised Multisite Site Creation and Privilege Escalation vulnerability

Subscriber+ Unauthorised Multisite Site Creation and Privilege Escalation vulnerability discovered by Jakub Herman in WordPress Plugin Theme My Login versions 7.0-7.1.15...

CVE-2026-81583

The My Login WordPress plugin before 7.2.0 does not enforce the network's registration setting when processing site signups on multisite installations, allowing users with a subscriber account, and unauthenticated users on some networks, to create new sites and be granted administrator over them...

CVE-2026-81583

The My Login WordPress plugin (versions 7.0-7.1.15 ) contains a vulnerability where it fails to enforce the network's registration settings during site signups on multisite installations . This flaw allows users with a subscriber account , and in some cases unauthenticated users , to create new s...

EUVD-2026-69857

The My Login WordPress plugin before 7.2.0 does not enforce the network's registration setting when processing site signups on multisite installations, allowing users with a subscriber account, and unauthenticated users on some networks, to create new sites and be granted administrator over them...

CVE-2026-81583 Theme My Login 7.0 - 7.1.15 - Subscriber+ Unauthorised Multisite Site Creation and Privilege Escalation

The My Login WordPress plugin before 7.2.0 does not enforce the network's registration setting when processing site signups on multisite installations, allowing users with a subscriber account, and unauthenticated users on some networks, to create new sites and be granted administrator over them...

CVE-2026-81583 Theme My Login 7.0 - 7.1.15 - Subscriber+ Unauthorised Multisite Site Creation and Privilege Escalation

The My Login WordPress plugin before 7.2.0 does not enforce the network's registration setting when processing site signups on multisite installations, allowing users with a subscriber account, and unauthenticated users on some networks, to create new sites and be granted administrator over them...

CVE-2026-81583: Improper Privilege Management

The My Login WordPress plugin before 7.2.0 does not enforce the network's registration setting when processing site signups on multisite installations, allowing users with a subscriber account, and unauthenticated users on some networks, to create new sites and be granted administrator over them...

PT-2026-84637

The My Login WordPress plugin before 7.2.0 does not enforce the network's registration setting when processing site signups on multisite installations, allowing users with a subscriber account, and unauthenticated users on some networks, to create new sites and be granted administrator over them...

CVE-2026-77194

The Simple Membership plugin for WordPress is vulnerable to Authentication Bypass leading to Administrator Account Takeover in versions up to, and including, 4.8.0. This is due to improper identity verification during the public registration flow in WordPress Multisite environments, where the...

CVE-2026-77194 Simple Membership <= 4.8.1 - Unauthenticated Authentication Bypass to Administrator Account Takeover via Multisite Identity Binding

The Simple Membership plugin for WordPress is vulnerable to Authentication Bypass leading to Administrator Account Takeover in versions up to, and including, 4.8.0. This is due to improper identity verification during the public registration flow in WordPress Multisite environments, where the...

CVE-2026-77194

The Simple Membership WordPress plugin (versions up to 4.8.0 , with a partial fix in 4.8.1) is affected by an unauthenticated Authentication Bypass that can lead to Administrator Account Takeover in WordPress Multisite environments. The root cause is improper identity verification during the publ...

CVE-2026-77194 Simple Membership <= 4.8.1 - Unauthenticated Authentication Bypass to Administrator Account Takeover via Multisite Identity Binding

The Simple Membership plugin for WordPress is vulnerable to Authentication Bypass leading to Administrator Account Takeover in versions up to, and including, 4.8.0. This is due to improper identity verification during the public registration flow in WordPress Multisite environments, where the...

EUVD-2026-69022

The Simple Membership plugin for WordPress is vulnerable to Authentication Bypass leading to Administrator Account Takeover in versions up to, and including, 4.8.0. This is due to improper identity verification during the public registration flow in WordPress Multisite environments, where the...

WordPress Simple Membership plugin <= 4.8.1 - Unauthenticated Authentication Bypass to Administrator Account Takeover via Multisite Identity Binding vulnerability

Unauthenticated Authentication Bypass to Administrator Account Takeover via Multisite Identity Binding vulnerability discovered by Kittipat Jitphonchana in WordPress Plugin Simple Membership versions = 4.8.1...

CVE-2026-77194: Improper Authentication

The Simple Membership plugin for WordPress is vulnerable to Authentication Bypass leading to Administrator Account Takeover in versions up to, and including, 4.8.0. This is due to improper identity verification during the public registration flow in WordPress Multisite environments, where the...

PT-2026-84148

The Simple Membership plugin for WordPress is vulnerable to Authentication Bypass leading to Administrator Account Takeover in versions up to, and including, 4.8.0. This is due to improper identity verification during the public registration flow in WordPress Multisite environments, where the...