https://vulnerability.circl.lu Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Sun, 04 Oct 2026 05:24:44 +0000 https://vulnerability.circl.lu/vuln/cve-2026-97337 <p><strong>Affected:</strong> wpinsider-1 Simple Membership</p> <p>The Simple Membership plugin for WordPress is vulnerable to unauthorized modification of data and sensitive information disclosure in versions up to, and including, 4.8.3 via the resend-activation and email-activation endpoints. The endpoints are dispatched from SwpmInitTimeTasks::check_and_do_email_activation() on frontend init with no authentication, nonce, capability, or ownership check, and the recipient address used by SwpmRegistration::send_reg_email() is taken from an attacker-controlled $_POST[&#39;email&#39;] parameter (overriding the member&#39;s registered address). This makes it possible for unauthenticated attackers to redirect an arbitrary pending member&#39;s activation email — and the follow-up &#39;registration complete&#39; email containing the member&#39;s username and plaintext password — to an attacker-chosen address, and to then activate that member&#39;s account without their consent.</p> <p><strong>Affected:</strong> wpinsider-1 Simple Membership</p> <p>The Simple Membership plugin for WordPress is vulnerable to unauthorized modification of data and sensitive information disclosure in versions up to, and including, 4.8.3 via the resend-activation and email-activation endpoints. The endpoints are dispatched from SwpmInitTimeTasks::check_and_do_email_activation() on frontend init with no authentication, nonce, capability, or ownership check, and the recipient address used by SwpmRegistration::send_reg_email() is taken from an attacker-controlled $_POST[&#39;email&#39;] parameter (overriding the member&#39;s registered address). This makes it possible for unauthenticated attackers to redirect an arbitrary pending member&#39;s activation email — and the follow-up &#39;registration complete&#39; email containing the member&#39;s username and plaintext password — to an attacker-chosen address, and to then activate that member&#39;s account without their consent.</p> https://vulnerability.circl.lu/vuln/cve-2026-97337