CVE-2026-15930 Simple Membership < 4.7.8 - Unauthenticated Administrator Account Takeover via Registration Username Collision

The Simple Membership WordPress plugin before 4.7.8 does not verify whether user creation failed during registration before using the returned value as a user ID to update an account, allowing unauthenticated attackers to overwrite the primary administrator's account data including the email...

CVE-2026-15930 Simple Membership < 4.7.8 - Unauthenticated Administrator Account Takeover via Registration Username Collision

The Simple Membership WordPress plugin before 4.7.8 does not verify whether user creation failed during registration before using the returned value as a user ID to update an account, allowing unauthenticated attackers to overwrite the primary administrator's account data including the email...

CVE-2026-15930

The Simple Membership WordPress plugin versions prior to 4.7.8 contains a vulnerability where it fails to verify if user creation failed during the registration process. Instead, it uses the returned value as a user ID to update an account. This oversight allows unauthenticated attackers to overw...