CVE-2023-41957 is a high severity (CVSS 8.6) privilege escalation flaw in the Simple Membership plugin for WordPress, in versions through 4.3.4. The Patchstack URL calls it unauthenticated, so no login is needed. We could not read the page, so the fixed version is unconfirmed; update to the latest release.
What's affected
The NVD record says Simple Membership is affected "from n/a through 4.3.4". The Patchstack URL in the record names the issue an unauthenticated membership role privilege escalation, and the vector agrees: no privileges and no user interaction are needed.
Patchstack blocked our automated request, so we could not confirm the patched release. Treat 4.3.4 and earlier as affected and move to the newest version. CVE-2023-41956 covers a separate account takeover flaw in the same plugin and range.
The record scores the flaw 8.6 (High) with the vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:L. It can be reached over the network, the attack complexity is low, it requires no privileges, and it needs no user interaction. The impact on confidentiality is low, on integrity high and on availability low. The weakness class is CWE-269 (improper privilege management). The record does not mark this CVE as being in the CISA Known Exploited Vulnerabilities catalog, and nothing we read says it is exploited in the wild.
How to check if you're exposed
Check the plugin version on every WordPress site you run. If you have WP-CLI access:
wp plugin get simple-membership --fields=name,status,version
Or open Plugins in the dashboard and read the version under Simple Membership. Anything at or below 4.3.4 is in the affected range. The fixed version was not confirmed; use the latest release and check the advisory. Do not forget staging copies and rarely visited sites, and remove plugins you no longer use.
What to do now
- Update Simple Membership to the latest release or later. With WP-CLI:
wp plugin update simple-membership. - Read the Patchstack entry for the exact fixed version.
- Audit membership levels and roles assigned to users, looking for unexpected upgrades.
- Check for new accounts with elevated roles created since the plugin was installed.
Why it matters
The weakness is CWE-269, improper privilege management. Because the vector needs no privileges, any visitor could be the starting point, which is why the score is high even though confidentiality impact is only low and integrity impact is high.
For a membership site, the role is the product. Someone granting themselves a paid or administrative level undermines both revenue and trust. Watch role assignments, not only the plugin version.
Quick check
Does an attacker need to sign in?
The vector shows no privileges required and the Patchstack URL says unauthenticated, so no.
What is the fixed version?
Not confirmed. We could not read the advisory. Update to the latest release and check it.
Sources
- Patchstack entry for Simple Membership 4.3.4 role escalation (linked from the record; access was blocked when we reviewed it)
- CVE-2023-41957 on Gold
Last reviewed: 19 October 2026.
