CVE-2026-97337 is a missing authorization vulnerability (CWE-862) in the Simple Membership WordPress plugin (versions up to and including 4.8.3). The resend-activation and email-activation endpoints are invoked during frontend initialization without any authentication, nonce, capability, or ownership verification. Attackers can supply an arbitrary email address via a POST parameter, causing the plugin to send activation and registration completion emails—including usernames and plaintext passwords—to attacker-controlled addresses. This allows unauthorized activation of pending member accounts without the legitimate user's consent.

An unauthenticated attacker can redirect sensitive emails containing usernames and plaintext passwords to arbitrary addresses, leading to sensitive information disclosure. Additionally, the attacker can activate a member's account without their consent, potentially enabling unauthorized access to that account. The vulnerability does not impact system availability or integrity beyond account activation and information disclosure.

No official patch or fix is currently documented. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict access to the affected endpoints if possible and monitor for suspicious activity related to account activations. Avoid using affected versions of the Simple Membership plugin in sensitive environments.