The Quarterly Threat Landscape Report is out. See what attackers are targeting now.Read report
The Simple Membership WordPress plugin before 4.7.8 does not verify whether user creation failed during registration before using the returned value as a user ID to update an account, allowing unauthenticated attackers to overwrite the primary administrator's account data (including the email address) and take over that account through the password reset flow.
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Simple Membership Plugin | — | Update simple-membership plugin to version 4.7.8, or a newer patched version | Aug 17, 2026 | Jul 24, 2026 |
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub