CVE-2026-15930

A vulnerability exists in Simple Membership plugin versions prior to 4.7.8, where it fails to check for registration failures before updating user information with a potentially invalid ID, enabling unauthorized attackers to modify the primary administrator's account details via the password recovery process. This flaw can be exploited by unauthenticated users to compromise the main administrator's email address and subsequently gain control over their account.

Based on public CVE data (MITRE/NVD).