EUVD-2026-42220
GHSA-2jfc-5xjv-8mv7
Severity by source
AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H
Network AJAX action with low complexity and an existing vendor account (PR:L); high integrity from arbitrary role changes, no confidentiality, and availability rated N since a role change is fundamentally an integrity effect (NVD assigned A:H).
Primary rating from Vendor (Wordfence).
CVSS VectorVendor: Wordfence
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H
Lifecycle Timeline
2DescriptionCVE.org
The WCFM Membership - WooCommerce Memberships for Multivendor Marketplace plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 2.11.10. This is due to the 'wcfmvm_membership_change' AJAX action not validating user permission to modify other users. This makes it possible for authenticated attackers, with vendor level access and above, to change any user's role to 'wcfm_vendor' by changing their membership plan.
AnalysisAI
Privilege escalation via Insecure Direct Object Reference in the WCFM Membership (WooCommerce Memberships for Multivendor Marketplace) WordPress plugin versions up to and including 2.11.10 lets authenticated users holding at least vendor-level access manipulate the 'wcfmvm_membership_change' AJAX action to reassign any user's account to the 'wcfm_vendor' role by altering their membership plan. Because the action never checks whether the caller is authorized to modify the targeted user, a low-privileged marketplace vendor can tamper with arbitrary accounts. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires the attacker to already hold an authenticated account with vendor-level access or above on a site running WCFM Membership 2.11.10 or earlier, and the site must expose the multivendor membership functionality (the 'wcfmvm_membership_change' AJAX action). … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 3.1 vector CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H describes a network-reachable, low-complexity attack requiring only low privileges (PR:L, i.e. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | An attacker registers or purchases a low-privileged vendor account on a WCFM-powered multivendor marketplace, then sends a crafted authenticated request invoking the 'wcfmvm_membership_change' AJAX action while substituting the target user's ID and a membership plan of their choosing. Because ownership is never validated, the server changes the victim's WordPress role to 'wcfm_vendor', letting the attacker tamper with arbitrary accounts. … |
| Remediation | Upstream fix available (PR/commit); released patched version not independently confirmed - the corrective change is committed in the WordPress plugin SVN repository at changeset 3520777 (https://plugins.trac.wordpress.org/changeset/3520777/wc-multivendor-membership), so administrators should update WCFM Membership to the latest available release beyond 2.11.10 as soon as it is published and review the Wordfence advisory at https://www.wordfence.com/threat-intel/vulnerabilities/id/8a934ccd-9330-4585-9994-838940d24980?source=cve for the confirmed fixed version. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours: Audit current plugin version across all instances; identify all active vendors with marketplace access; document current vendor roster. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Same technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today