What is the CVSS score of CVE-2026-28070?

CVE-2026-28070 has a CVSS 3.1 base score of 5.3 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N. EPSS exploitation probability: 0.0%.

Which versions of Wp Emember are affected by CVE-2026-28070?

Organizations using Missing Authorization vulnerability in Tips and Tricks HQ WP eMember should be aware of moderate risk from CVE-2026-28070, a missing authorization vulnerability rated CVSS 5.3.

How to fix or mitigate CVE-2026-28070?

Within 30 days: Identify affected systems and apply vendor patches as part of regular patch cycle. Monitor vendor channels for patch availability.

Wp Emember CVE-2026-28070

EUVD-2026-13049 MEDIUM

Missing Authorization (CWE-862)

2026-03-19 Patchstack

Authentication Bypass Wp Emember

5.3

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

5.3 MEDIUM

AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

Low

Integrity

None

Availability

None

Lifecycle Timeline

EUVD ID Assigned

Mar 19, 2026 - 05:30 euvd

EUVD-2026-13049

Analysis Generated

Mar 19, 2026 - 05:30 vuln.today

CVE Published

Mar 19, 2026 - 05:20 nvd

MEDIUM 5.3

DescriptionCVE.org

Missing Authorization vulnerability in Tips and Tricks HQ WP eMember allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WP eMember: from n/a through v10.2.2.

AnalysisAI

WP eMember through version 10.2.2 contains an authorization bypass flaw that allows unauthenticated remote attackers to circumvent access control restrictions and view protected content. The vulnerability stems from improper validation of security level configurations, enabling unauthorized information disclosure without user interaction. No patch is currently available for this issue.

Technical ContextAI

WP eMember is a WordPress membership plugin by Tips and Tricks HQ that manages access control and member authentication through custom security levels and authorization rules. The vulnerability root cause is classified under CWE-862 (Missing Authorization), which describes the failure to enforce proper access control checks before granting access to protected resources. Rather than a cryptographic or authentication failure, this is an authorization logic flaw where the plugin's access control decision points do not properly validate user permissions against configured security levels before rendering restricted content or functionality. The affected CPE (cpe:2.3:a:tips_and_tricks_hq:wp_emember:*:*:*:*:*:*:*:*) confirms the vulnerability spans all versions from inception through 10.2.2, suggesting the authorization flaw is endemic to the core access control implementation rather than introduced in a recent update.

RemediationAI

Update WP eMember to the latest patched version released by Tips and Tricks HQ immediately through the WordPress plugin dashboard or by downloading directly from the vendor. Consult the Patchstack vulnerability advisory (https://patchstack.com/database/wordpress/plugin/wp-emember/vulnerability/wordpress-wp-emember-plugin-v10-2-2-broken-access-control-vulnerability?_s_id=cve) for the specific patched version number. Until patching is completed, restrict network access to the WordPress site to trusted IP ranges via firewall or Web Application Firewall (WAF) rules, implement additional authorization checks at the web server level using htaccess or nginx directives, and consider temporarily disabling public-facing member-restricted content to prevent unauthorized information disclosure. Review access logs for signs of exploitation attempts and validate that all existing member accounts have appropriate security level assignments.