The Simple Membership WordPress plugin fails to verify whether a user registration succeeded before using the returned value as a user ID to update an account. This logic flaw allows an unauthenticated attacker to register a new user with the same username as the site’s original administrator. The plugin then overwrites the administrator’s account data, including the email address, and the attacker can immediately trigger a password reset to take over the account. The result is full control of the WordPress site’s administrative privileges. The weakness is an improper access control flaw that permits privilege escalation.

WordPress sites using the Simple Membership plugin version 4.7.7 or earlier are vulnerable. No specific vendor name is provided beyond the plugin identifier. Sites must confirm they are running a pre‑4.7.8 release to determine risk.

The vulnerability can be exploited by any unauthenticated user who can submit a registration request, so network restrictions are minimal. Exploit probability is considered low due to the EPSS score of < 1%, yet the absence of authentication and the clear path to takeover render the risk high. The vulnerability is not listed in the CISA KEV catalog. The CVSS score of 9.4 indicates extremely high severity, underscoring the urgent need for remediation.