Memberful Membership Plugin CVE-2026-103067

Exploitation requires an authenticated, privileged victim (effectively a WordPress administrator or logged-in member with Memberful management rights) to be actively logged in AND to be socially engineered into visiting an attacker-controlled page or clicking a crafted link while that session is valid (UI:R). The vulnerable Memberful plugin endpoint must lack proper CSRF nonce/token validation; the specific setting or action affected is not named in the Patchstack advisory. Limiting factors: no attacker authentication to the target is needed, but success is bounded by the required user interaction and the victim's active privileged session - it cannot be triggered against a logged-out user or without the victim's browser action, and it affects installations running Memberful through version 1.81.0.

This is a CWE-352 Cross-Site Request Forgery flaw in the Memberful WordPress membership plugin (versions up to and including 1.81.0), reported by Patchstack. The Patchstack/NVD CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H = 8.0 High) claims full confidentiality, integrity and availability impact, which is unusually high for a CSRF issue and typically reflects a state-changing action (e.g. settings modification or privileged operation) forced in an authenticated administrator's browser. No EPSS score, no CISA KEV listing, and no public proof-of-concept are present in the supplied data, so there is no public exploit identified at time of analysis and no evidence of active exploitation - real-world risk is gated primarily by the need for social engineering. The signals are therefore somewhat conflicting: the raw score is High, but every successful attack is bounded by UI:R (an authenticated victim, in practice an admin, must visit an attacker-controlled page while logged in), making this a realistic-but-not-wormable, targeted-phishing-dependent issue rather than a mass-exploitation priority. One discrepancy to verify with the vendor: CSRF normally carries PR:N (the attacker holds no privileges; the victim's session supplies them), yet the input lists PR:L - the precise privilege level of the tricked victim and the exact affected action are not detailed in the terse Patchstack description and should be confirmed before relying on the C:H/I:H/A:H impact rating.

An attacker crafts a malicious web page (or email link) containing a hidden auto-submitting form or forged request targeting a Memberful plugin endpoint that lacks CSRF nonce validation. When a logged-in WordPress administrator or privileged member visits the page while their session is active, the browser silently submits the forged request, performing an unintended state-changing action (such as altering plugin/membership configuration) with the victim's privileges. No public PoC is available, and success requires the victim to be authenticated and to interact with the attacker-supplied content (UI:R).