If you received an email from me pointing you to this page, it is because your website appears to be running a version of Simple Membership (the WordPress membership plugin by smp7 / wp.insider, which lives in your files at /wp-content/plugins/simple-membership/) that falls within the affected range of a known security issue. This page explains what the issue is, how to check which version you have, how to update, and the follow-up step that matters most afterwards.

The issue is CVE-2026-15930, an unauthenticated administrator account takeover through the plugin’s own membership registration form. It affects every release before 4.7.8 and is fixed in 4.7.8. If you are running anything older than 4.7.8, update Simple Membership to 4.7.8 or later (4.7.9 came later and keeps the fix, so it is fine too).

One thing to be clear about, because it differs from some of the other notices I have sent: there is no older version that is safe. This is not a flaw that was introduced at some point and then fixed. It was present in the plugin from its earliest published release right through to 4.7.7, so “my install is too old to be affected” is not a way out here. The only versions that are not affected are 4.7.8 and newer.

This notice also does not depend on how your site is configured. There is no setting that has to be switched on: when the plugin is activated it publishes a membership-registration page carrying its registration form, so a stock installation exposes the form to visitors who are not logged in. If your version is older than 4.7.8, the update is worth doing promptly.

This is a plugin flaw, not a WordPress core flaw. A fully up-to-date WordPress does not protect you if the Simple Membership plugin itself is on an affected version.

Is this message legitimate?

Yes. This is a good-faith, responsible-disclosure notice from an independent security researcher. I am not asking you for money, passwords, or access to your site, and I have not attempted to break into it, submit anything to it, or exploit anything.

All I did was look at publicly visible files that your website serves to every visitor (the same way your homepage is public) and note the version number that the plugin publishes. I specifically did not submit your registration form or send anything to it, and nothing about this check touches your data, your admin area, or any private part of your site (more detail under What I did and did not do below).

If you would like to verify who I am, see the contact details at the bottom of this page and the About page.

Why this matters

Simple Membership adds membership levels and protected content to a WordPress site, and it gives visitors a public sign-up form so they can register for a membership themselves. That form is the entry point here.

In affected versions, the plugin did not check whether WordPress had actually created the new account before it went on to save the details that were submitted. When the requested sign-up could not be created as a genuinely new user because the chosen name collided with an account that already existed, the plugin carried on regardless and wrote the submitted details onto that existing account. The practical effect: the email address and password typed into the public sign-up form become the sign-in details of an account that was already on the site. In practice the account that ends up overwritten is the site’s original administrator, which hands control of the site to whoever filled in the form.

Two things are worth stating plainly. First, no login is required and nothing has to be misconfigured: an anonymous visitor and the registration page the plugin publishes by itself are enough. Second, the outcome is administrative control rather than a limited data leak, which is why the recommendation here is to update promptly rather than to fold it into your next maintenance window.

I am describing this at the level a site owner needs in order to act, and no further. I am not publishing the details that would let someone reproduce it, and I would ask you not to try it against your own site or anyone else’s. Reading your version number, as described below, tells you everything you need to decide what to do.

If my email cited this issue, it means the version your site reports is older than 4.7.8. I did not test whether your particular site is exploitable; all I observed is the version.

Am I affected?

It comes down to one question: which version of Simple Membership are you running? You do not have to take my word for it, and there are three ways to check. Unlike some plugins I write about, all three are trustworthy here, because they all report the same underlying version number.

From the WordPress admin area (authoritative):

  1. Log in to your WordPress dashboard (usually at yourdomain.com/wp-admin).
  2. Go to Plugins then Installed Plugins.
  3. Find Simple Membership, the entry whose folder is simple-membership, and note the version shown beneath its name.

From the public manifest (no login needed): open yourdomain.com/wp-content/plugins/simple-membership/readme.txt in a browser. The Stable tag: line near the top is the version your install reports, and this is the same public file I read.

From your page source (no login needed): view the source of any page on your site and look for the plugin’s stylesheet, css/swpm.common.css, under /wp-content/plugins/simple-membership/. The ?ver= number attached to it is the plugin version, stamped from the plugin’s own version constant, so for this plugin it is a dependable read rather than a decoy.

Then apply this rule, and note that versions compare numerically, not alphabetically, so 4.7.10 would be newer than 4.7.8 even though it looks smaller as text:

  • Anything older than 4.7.8: affected. Update now. There is no cut-off below which an older release becomes safe again.
  • 4.7.8 or newer: already fixed. This includes 4.7.9, which keeps the fix.

A note on Simple Membership’s add-ons. The plugin’s paid add-ons install as separate plugins, in their own folders, on their own version lines. An add-on’s version number says nothing at all about this issue. The version that matters is the one on the core Simple Membership plugin, folder simple-membership, from any of the three checks above.

How to upgrade

The safest path is to update through WordPress itself, and to back up first:

  1. Back up your site (files and database) before making changes. Most hosting providers offer one-click backups, or use a WordPress backup plugin.
  2. In the WordPress admin, go to Dashboard then Updates, or Plugins then Installed Plugins. If a Simple Membership update is listed, install it from here.
  3. If you prefer the command line, WP-CLI does the same thing: wp plugin update simple-membership.
  4. If no update appears, you can get the latest release directly from the plugin’s page on the WordPress.org directory, Simple Membership, and update via Plugins then Add New Plugin then Upload Plugin.
  5. After updating, confirm the new version number (4.7.8 or later) using the steps above, and check that your registration form, membership levels and protected content still work normally.

If you use Simple Membership’s paid add-ons, update those alongside the core plugin, since their releases are usually paired.

While you are in there, it is worth confirming that WordPress core and your other plugins are up to date, since the same principle applies to all of them.

After updating

Updating to 4.7.8 or later closes the issue. There is one follow-up here that is more important than the usual housekeeping, and it is worth reading even if you are confident nothing happened.

The usual advice would miss this one. When people check a site after a takeover flaw, they look for unfamiliar new administrator accounts. That check would not find anything here, because no new account is created. An account that already existed is overwritten, so the number of administrators does not change and no unrecognised name appears in the list. What changes is the sign-in details on an account you already know about. So:

  • Check the email address on every administrator account. In the WordPress admin, go to Users, filter to Administrator, and confirm that each one still carries the email address it should. An administrator account whose email address is no longer the right person’s is the tell for this issue.
  • Reset the passwords on your administrator accounts, and on any other accounts that matter. Do this even if the email addresses all look correct.
  • Regenerating WordPress’s secret keys and salts in wp-config.php is a sensible companion step (new values are one click away at the official secret-key generator; swapping them signs all users out once).

Please note that updating closes the hole, but it does not undo access that was already taken. If someone had taken over an account before you updated, they still hold those sign-in details afterwards, which is exactly why the password reset above matters. If you find something that concerns you, treat it as you would any other suspected unauthorized access.

I have no visibility into whether anything actually happened on your site, and I did not look. This is a precautionary notice, not an incident report.

What I did and did not do

To be fully transparent about the check behind my email: I only read two public files that your site already serves to every visitor, specifically the plugin’s public readme.txt file and your homepage. I did not access your WordPress admin area, your database, or any private part of the site.

In particular, I never submitted your registration form or sent anything to it. Nothing was submitted, tested, or exploited. That matters more here than on most of these pages, because the registration form is the exact thing this issue concerns, so “I did not touch it” is the whole difference between a disclosure and an intrusion.

I am also deliberately not publishing the details that would help someone act on this issue. The description above stops at the level a site owner needs, and I do not link any proof-of-concept code.

This is a version-based observation: your site reports a version older than 4.7.8. A site in that range may already be protected by other means, such as a web application firewall or a backported fix. This notice is not a statement that your site was exploitable at the time I checked.

I do not have a webmaster / I am stuck

If you are not the person who maintains the site, please forward this page to whoever does (your web developer, agency, or hosting provider). They will recognize the steps above quickly.

If you are maintaining the site yourself and get stuck, I am happy to help point you in the right direction at no cost. Reach out using the contact details below.

Contact

Evan Harris, Security Researcher

I reach out about issues like this purely to help operators secure their sites. If you would prefer not to be contacted again, just let me know and I will honor that.

References

Official advisories and tracking

Vendor / plugin