CVE-2023-41957 HIGH

CVE-2023-41957: WordPress Simple Membership plugin <= 4.3.4 - Unauthenticated Membership Role Privilege Escalation vulnerability

Vendor Smp7, Wp.insider
Product Simple Membership
Weakness CWE-269
Published May 17, 2024
Last update April 28, 2026
View on NVD All CVEs

CVSS base score

8.6/10
Attack vector Network
Attack complexity Low
Privileges required None
User interaction None
Confidentiality Low
Integrity High

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:L

What the vulnerability does

01Description

Improper Privilege Management vulnerability in smp7, wp.Insider Simple Membership allows Privilege Escalation.This issue affects Simple Membership: from n/a through 4.3.4.

Explanation of Vulnerability in Simple Terms

02Summary

Simple Membership versions up to 4.3.4 contain a privilege management flaw that allows unauthenticated attackers to modify user roles and permissions. The vulnerability requires no user interaction and can be exploited over the network. An attacker can escalate their own account or demote administrators, compromising site access control.

What an attacker can do

03Attacker Capabilities

Change user roles and permissions without authentication, including promoting themselves to admin.

Potential impact on your site

04Site Impact

Attackers can take over admin accounts or create new administrators, gaining full control of your site.

Conditions required to exploit

05Prerequisites

Network access only; no authentication or user interaction required.

Key dates

06Disclosure timeline

May 17, 2024 CVE published
April 28, 2026 Record updated

Related vulnerabilities

08Related CVE

CVE-2025-6254 Doctreat Core <= 1.6.8 - Unauthenticated Privilege Escalation CVE-2026-5144 BuddyPress Groupblog <= 1.9.3 - Authenticated (Subscriber+) Privilege Escalation to Administrator via Group Blog IDOR CVE-2025-8572 Truelysell Core <= 1.8.7 - Unauthenticated Privilege Escalation via Registration CVE-2026-7641 Import and export users and customers <= 2.0.8 - Authenticated (Subscriber+) Privilege Escalation via Multisite Capability Meta Fields CVE-2026-8719 AI Engine 3.4.9 - Authenticated (Subscriber+) Privilege Escalation via Missing Authorization in MCP OAuth Bearer Token