CVE-2026-97337

Summary

The Simple Membership plugin allows unauthenticated attackers to hijack member account activations by redirecting activation emails to attacker-controlled addresses, potentially gaining unauthorized access to user accounts without their consent.

Exploitability

Exploitation is straightforward with no prerequisites, requiring only access to the resend-activation and email-activation endpoints on a vulnerable WordPress site.

Blast radius

The impact could be significant as attackers can activate arbitrary pending member accounts and receive sensitive account credentials via email, potentially leading to unauthorized access to user accounts.

Detection

Monitor for unusual email activation requests in plugin logs or HTTP access logs targeting the /wp-content/plugins/simple-membership/ endpoints, particularly when email addresses are submitted via POST parameters.

Prioritized remediation

Upgrade to version 4.8.4 or later which fixes the authentication vulnerability in the resend-activation and email-activation endpoints.

Analysis generated locally by garnet-coder (no data left the box). AI-assisted — verify against primary sources before acting.