CVE-2026-15930

9.4 Critique

Publiée le 03/08/2026 à 09:16 · Modifiée le 26/08/2026 à 18:31 · Analyse NVD reportée · Source : contact@wpscan.com

Description

The Simple Membership WordPress plugin before 4.7.8 does not verify whether user creation failed during registration before using the returned value as a user ID to update an account, allowing unauthenticated attackers to overwrite the primary administrator's account data (including the email address) and take over that account through the password reset flow.

Traduire en français

Produits concernés

Unknown Simple Membership

Scores CVSS

Version	Score	Source	Vecteur
3.1	9.4 Critique	134c704f-9b21-4f2e-91b3-4a467353bcc0	`CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:H`

Faiblesses (CWE)

CWE-862

Références

https://wpscan.com/vulnerability/e46948f1-0e06-4e76-8fc8-df661eb786a5/

Ailleurs

NVD
CVE.org
CIRCL Vulnerability-Lookup
CERT-FR
GitHub Advisories