Authentication Bypass in Simple Membership Plugin for WordPress

CVE-2026-77194

What is CVE-2026-77194?

The Simple Membership plugin for WordPress exhibits a vulnerability allowing unauthorized users to bypass authentication and take over administrator accounts on child sites within a Multisite environment. This security gap arises from inadequate identity verification during the public registration process, specifically where the plugin associates new Simple Membership records with global WordPress users based on matching usernames and emails alone. As a result, an attacker can create an account using a victim's credentials on a site with public registration enabled, subsequently gaining access by updating the victim's global WordPress password through profile editing. This vulnerability highlights the need for robust security measures in identity verification to prevent unauthorized access.

References