Simple Membership WordPress Plugin Account Takeover

Executive Summary

This vulnerability in the Simple Membership WordPress plugin before version 4.7.8 allows unauthenticated attackers to overwrite the primary administrator's account data, including the email address, by exploiting a flaw during user registration where the plugin does not check if user creation failed before using the returned value as a user ID.

Useful 0 Not Useful 0

Detection Guidance

Check if the Simple Membership WordPress plugin version is below 4.7.8. Inspect user registration flows for unauthenticated overwrites of administrator accounts. Look for unexpected changes in admin email addresses or account details.

Useful 0 Not Useful 0

Impact Analysis

If you use this plugin, an attacker could take over your WordPress administrator account by resetting the password after modifying the email address. This could lead to full control over your website, data theft, or malicious content injection.

Useful 0 Not Useful 0

Mitigation Strategies

Update the Simple Membership plugin to version 4.7.8 or higher immediately. Review admin accounts for unauthorized changes. Consider disabling user registration temporarily if not required.

Useful 0 Not Useful 0