CVE-2026-77194: Simple Membership WordPress Auth Bypass

CVE-2026-77194 Overview

The Simple Membership plugin for WordPress contains an authentication bypass vulnerability affecting versions up to and including 4.8.0. The flaw resides in the public registration flow within WordPress Multisite environments. The plugin binds new Simple Membership records to existing global WordPress users based solely on matching username and email address. It does not require password verification or proof of account ownership. The plugin also fails to properly detect Administrator roles on child sites. Unauthenticated attackers can register a Simple Membership account using a victim's credentials on any child site with public registration enabled. They then update the victim's global WordPress password through the profile edit functionality, taking over the Administrator account. The issue was partially patched in version 4.8.1.

Critical Impact
Unauthenticated attackers can hijack Administrator accounts on child sites across WordPress Multisite networks running vulnerable versions of Simple Membership with public registration enabled.

Affected Products

WordPress Simple Membership plugin versions up to and including 4.8.0
WordPress Multisite environments with public registration enabled
Child sites in Multisite networks where victim users hold Administrator roles

Discovery Timeline

2026-09-01 - CVE-2026-77194 published to NVD
2026-09-01 - Last updated in NVD database

Technical Details for CVE-2026-77194

Vulnerability Analysis

The vulnerability is classified as an authentication bypass [CWE-287] in the registration workflow of the Simple Membership plugin. The plugin exposes a public registration form that creates new membership records. During processing, it checks whether a WordPress user with a matching username and email already exists. When a match is found, the plugin links the new Simple Membership record to that existing global WordPress account without verifying ownership.

The issue is compounded by faulty role detection logic. The plugin evaluates user roles only against the current child site context and does not correctly identify Administrator privileges assigned on other sites within the Multisite network. An attacker can therefore target Administrator accounts on any child site where public Simple Membership registration is enabled. Once linked, the profile edit functionality allows the attacker to change the victim's global WordPress password, completing the account takeover.

Root Cause

The root cause is improper identity verification during account linkage. The plugin treats a matching user_login and user_email combination as sufficient proof of identity. It performs no password challenge, email confirmation, or ownership check before associating the new Simple Membership record with an existing WordPress user. The role-detection routine also fails to enumerate roles across all sites in the Multisite network.

Attack Vector

The attack is network-based and requires no authentication or user interaction. An attacker locates a child site in a Multisite network with public Simple Membership registration enabled. The attacker submits the registration form using the target Administrator's known user_login and user_email values. The plugin binds the new membership to the existing global WordPress account. The attacker then uses the profile edit functionality to reset the victim's WordPress password and log in as the Administrator. Technical references for the affected code paths are available in the Simple Membership Form Class, Registration Class, and Utils Member Class.

Detection Methods for CVE-2026-77194

Indicators of Compromise

New Simple Membership registrations on child sites where the submitted username and email match existing Administrator or privileged WordPress accounts
Password change events on global WordPress accounts immediately following a Simple Membership registration on any child site
Unexpected Administrator logins from unfamiliar IP addresses shortly after a membership profile edit
Simple Membership records linked to WordPress user IDs that hold elevated privileges on other network sites

Detection Strategies

Correlate wp_users and swpm_members_tbl records to identify Simple Membership entries linked to Administrator accounts created via public registration
Review web server access logs for POST requests to the Simple Membership registration endpoint followed by requests to the profile edit endpoint from the same source
Audit WordPress activity logs for password changes on privileged accounts that were not initiated by the account owner

Monitoring Recommendations

Enable verbose WordPress audit logging for user profile changes, password resets, and role assignments across all Multisite child sites
Monitor plugin registration endpoints for high-volume or scripted submissions targeting known Administrator usernames
Alert on any Simple Membership account creation that resolves to a pre-existing WordPress user with elevated network-level privileges

How to Mitigate CVE-2026-77194

Immediate Actions Required

Update the Simple Membership plugin to version 4.8.1 or later on all sites in the Multisite network, noting that the fix is described as partial
Disable public Simple Membership registration on child sites until the plugin can be updated and audited
Force password resets and review recent login activity for all Administrator accounts across Multisite child sites
Enable multi-factor authentication for all Administrator and Super Admin accounts

Patch Information

The vendor released a partial fix in Simple Membership 4.8.1. Relevant code changes are tracked in Changeset #3668897 and Changeset #3673368. Additional context is available in the Wordfence Vulnerability Report. Administrators should continue to monitor the plugin repository for a complete remediation.

Workarounds

Disable public registration in the Simple Membership plugin settings on all Multisite child sites
Restrict access to the plugin registration endpoint using web application firewall rules or server-level allowlists
Remove the Simple Membership plugin from child sites where it is not required for business functionality
Audit and reduce the number of accounts holding Administrator privileges on child sites to minimize the attack surface

bash

# Configuration example: disable public registration via WP-CLI across a Multisite network
wp site list --field=url | while read SITE; do
  wp option update swpm_enable_free_membership 0 --url="$SITE"
done