CVE-2023-41956 is a high severity (CVSS 8.8) improper authentication flaw in the Simple Membership plugin for WordPress, in versions through 4.3.4. The Patchstack URL calls it an authenticated account takeover. We could not read the page, so the fixed version is unconfirmed; update to the latest release and check the advisory.
What's affected
The NVD record says Simple Membership is affected "from n/a through 4.3.4". The Patchstack URL in the record names the issue an authenticated account takeover vulnerability.
Patchstack blocked our automated request, so we could not confirm the fixed release. Treat 4.3.4 and earlier as affected and install the newest release. A related CVE for the same plugin and range, CVE-2023-41957, covers a different flaw.
The record scores the flaw 8.8 (High) with the vector CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H. It can be reached over the network, the attack complexity is low, it requires low privileges, and it needs no user interaction. The impact on confidentiality is high, on integrity high and on availability high. The weakness class is CWE-287 (improper authentication). The record does not mark this CVE as being in the CISA Known Exploited Vulnerabilities catalog, and nothing we read says it is exploited in the wild.
How to check if you're exposed
Check the plugin version on every WordPress site you run. If you have WP-CLI access:
wp plugin get simple-membership --fields=name,status,version
Or open Plugins in the dashboard and read the version under Simple Membership. Anything at or below 4.3.4 is in the affected range. The fixed version was not confirmed; use the latest release and check the advisory. Do not forget staging copies and rarely visited sites, and remove plugins you no longer use.
What to do now
- Update Simple Membership to the latest release or later. With WP-CLI:
wp plugin update simple-membership. - Read the Patchstack entry for the exact fixed version.
- Look at recent password resets and role changes on membership sites.
- Reset passwords for administrator accounts if you see anything unexpected.
Why it matters
The weakness is CWE-287, improper authentication. The code did not verify identity correctly in one path, which the advisory title describes as account takeover by an authenticated user. The vector needs low privileges and no user interaction, with high impact on all three areas.
Membership plugins gate paid content and personal data. A takeover bug here can reach both. The fix is a plugin update; the lasting control is limiting who can register and watching role changes.
Quick check
Is this the same as CVE-2023-41957?
No. Both affect Simple Membership through 4.3.4, but CVE-2023-41957 is a privilege escalation flaw that needs no login.
Which version fixes it?
We could not confirm it from the advisory. Update to the latest release and check the advisory.
Sources
- Patchstack entry for Simple Membership 4.3.4 account takeover (linked from the record; access was blocked when we reviewed it)
- CVE-2023-41956 on Gold
Last reviewed: 19 October 2026.
