WCFM Membership CVE-2026-3688

Exploitation requires the attacker to already hold an authenticated account with vendor-level access or above on a site running WCFM Membership 2.11.10 or earlier, and the site must expose the multivendor membership functionality (the 'wcfmvm_membership_change' AJAX action). The specific abused feature is the membership-plan change flow, which reassigns WordPress roles; the attacker manipulates the user-identifier parameter to target another account. Limiting factors: the flaw is not unauthenticated (PR:L confirms a valid vendor login is needed), so sites that do not grant vendor accounts to untrusted parties or that gate vendor onboarding behind manual approval materially reduce exposure; there is no user-interaction requirement (UI:N) and no confidentiality impact, and the outcome is constrained to setting the victim's role to 'wcfm_vendor' rather than an arbitrary role.

The CVSS 3.1 vector CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H describes a network-reachable, low-complexity attack requiring only low privileges (PR:L, i.e. authenticated vendor-level access) and no user interaction, with high integrity and availability impact but no confidentiality impact. This aligns with the description: an existing marketplace vendor can escalate/alter roles but does not directly read protected data. No EPSS score, KEV listing, POC, or SSVC decision data was provided, so probabilistic and active-exploitation signals are absent - this should be treated as a real but not confirmed-exploited issue. The A:H rating is arguable: reassigning an administrator to 'wcfm_vendor' could strip their privileges (an availability/integrity effect), but a simple role change is more naturally an integrity impact, so the availability weighting may be inflated. Overall this is a genuine authorization flaw on any multivendor site that grants vendor accounts to semi-trusted third parties, though the requirement for a pre-existing vendor account limits the attacker population versus a fully unauthenticated flaw.

An attacker registers or purchases a low-privileged vendor account on a WCFM-powered multivendor marketplace, then sends a crafted authenticated request invoking the 'wcfmvm_membership_change' AJAX action while substituting the target user's ID and a membership plan of their choosing. Because ownership is never validated, the server changes the victim's WordPress role to 'wcfm_vendor', letting the attacker tamper with arbitrary accounts. No public exploit code has been identified, and the attack requires an existing authenticated vendor session (AV:N/AC:L/PR:L/UI:N).