CVE-2026-15930

The CVE concerns the Simple Membership WordPress plugin prior to version 4.7.8. It fails to verify whether user creation failed during registration before reusing the returned value as a user ID to update an account, allowing unauthenticated attackers to overwrite the primary administrator’s acco...