What is GHSA-7g75-5pmj-3v8p?

GHSA-7g75-5pmj-3v8p is a security advisory published by GitHub Security Advisories with Critical severity. The Simple Membership WordPress plugin before 4.7.8 does not verify whether user creation failed...

Which CVE IDs does GHSA-7g75-5pmj-3v8p cover?

GHSA-7g75-5pmj-3v8p covers the following CVE IDs: CVE-2026-15930. Each CVE has its own detail page on EchelonGraph Pulse with the synthesized EG score.

What is the CVSS v3 score of GHSA-7g75-5pmj-3v8p?

GHSA-7g75-5pmj-3v8p has a CVSS v3 base score of 9.4, published by GitHub Security Advisories.

GHSA-7g75-5pmj-3v8pCriticalCVSS 9.4

The Simple Membership WordPress plugin before 4.7.8 does not verify whether user creation failed...

Vendor

GitHub Security Advisories

Published

August 3, 2026

Last Modified

August 3, 2026

🔗 CVE IDs covered (1)

CVE-2026-15930 →

📋 Description

The Simple Membership WordPress plugin before 4.7.8 does not verify whether user creation failed during registration before using the returned value as a user ID to update an account, allowing unauthenticated attackers to overwrite the primary administrator's account data (including the email address) and take over that account through the password reset flow.

🔗 References (3)

https://nvd.nist.gov/vuln/detail/CVE-2026-15930
https://wpscan.com/vulnerability/e46948f1-0e06-4e76-8fc8-df661eb786a5
https://github.com/advisories/GHSA-7g75-5pmj-3v8p