CVE-2026-97337

{
  "etk_id": "ETK-2026-424",
  "cve_id": "CVE-2026-97337",
  "display_id": "CVE-2026-97337",
  "ghsa_id": "GHSA-7wr9-4367-v9vm",
  "euvd_id": "EUVD-2026-91908",
  "status": "published",
  "anchor_state": "anchored",
  "title": "Missing authorization in Simple Membership activation endpoints",
  "summary": "Simple Membership versions through 4.8.3 expose activation and resend workflows without authorization checks. An unauthenticated attacker can target a pending member to redirect account emails, obtain sensitive account information, and activate the account; a pending membership is required.",
  "mitigation": "Disable the Simple Membership plugin or restrict public access to its activation and resend workflows until an updated release is available. Review pending accounts and activation activity for unexpected changes.",
  "vendor": "wpinsider-1",
  "product": "Simple Membership",
  "affected": [
    {
      "affected_notes": [],
      "affected_ranges": [
        ">= 0, <= 4.8.3"
      ],
      "ecosystem": null,
      "fixed_versions": [],
      "package_name": "Simple Membership",
      "purl": null
    }
  ],
  "cwes": [
    862
  ],
  "cvss_score": 7.5,
  "cvss_src": "cna_vendor",
  "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
  "epss_score": 0.0037,
  "epss_percentile": 0.299,
  "epss_asof": "2026-10-20",
  "automation": "deterministic",
  "check": true,
  "check_confidence_basis": "differential",
  "exploit": false,
  "pipeline_minutes": 20.9334299,
  "t0_at": "2026-10-03T05:29:16.871000+00:00",
  "signals": {
    "check": {
      "at": "2026-10-03T07:03:56.224167+00:00",
      "days": 0.06573325424768518,
      "is_lower_bound": false,
      "measured_at": "2026-10-03T05:29:16.871000+00:00",
      "url": null
    },
    "trigger_signal": {
      "at": "2026-10-03T05:29:16.871000+00:00",
      "days": 0,
      "is_lower_bound": false,
      "measured_at": "2026-10-03T05:29:16.871000+00:00",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-97337"
    }
  }
}