An authorization flaw in Simple Membership allows a user to exploit incorrectly configured access control security levels. The vulnerability enables bypassing intended restrictions, giving the attacker broader access to protected areas or content. It is identified as a broken access control weakness (CWE-862).

The Simple Membership plugin for WordPress, version 4.6.9 and earlier, is affected. This includes all installations of the plugin where the security level setting has been modified or remains at the default insecure configuration. The impact applies to any WordPress site using these plugin versions.

The CVSS score of 4.3 indicates moderate severity. The EPSS score is below 1%, suggesting a low probability of widespread exploitation at this time. The vulnerability is not listed in the CISA KEV catalog. Attackers are likely to use this flaw by interacting with the plugin’s configuration interfaces or by submitting content that triggers elevated privilege checks. Successful exploitation would allow an attacker to bypass authentication controls, potentially gaining unauthorized access to restricted content or administrative functions.