Simple Membership < 4.7.8 - Unauthenticated Administrator Account Takeover via Registration Username Collision
48Vexday Risk Score
No sign of exploitation. It has a public proof of concept.
ssvc Attendcvss 9.4epss 0.2%
exploitation probability
0.2%top 86% of all CVEs
observed exploitation
nono source reports it
1 public exploit(s)
The Simple Membership WordPress plugin before 4.7.8 does not verify whether user creation failed during registration before using the returned value as a user ID to update an account, allowing unauthenticated attackers to overwrite the primary administrator's account data (including the email address) and take over that account through the password reset flow.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:H
Affected products
Unknown · Simple Membershippublic PoCs found — 1
cve_referencewpscan.com/vulnerability/e46948f1-0e06-4e76-8fc8-df661eb786a5/unverified⚠ Public resources, to assess the exposure of systems you control or are authorized to test. Test only with authorization.