What is the CVSS score of CVE-2026-3688?

CVE-2026-3688 has a CVSS 3.1 base score of 8.1 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H. EPSS exploitation probability: 0.2%.

Which versions of WCFM Membership are affected by CVE-2026-3688?

The WCFM Membership WordPress plugin (versions ≤2.11.10) used in WooCommerce multivendor marketplaces contains a privilege escalation vulnerability allowing any authenticated vendor to reassign…

How to fix or mitigate CVE-2026-3688?

Within 24 hours: Audit current plugin version across all instances; identify all active vendors with marketplace access; document current vendor roster. Within 7 days: Deploy compensating controls by restricting the 'wcfmvm_membership_change' AJAX endpoint via Web Application Firewall or WordPress security plugin; disable vendor self-service membership changes; enable comprehensive audit logging on all user role modifications. Within 30 days: Monitor for vendor security patches; evaluate alternative membership plugins; conduct forensic audit of account role changes since plugin deployment to detect unauthorized escalations.

WCFM Membership CVE-2026-3688

EUVD-2026-42220 HIGH

Authorization Bypass Through User-Controlled Key (CWE-639)

2026-07-08 Wordfence

GHSA-2jfc-5xjv-8mv7

WordPress Authentication Bypass Wordpress Plugin Wcfm Membership Woocommerce Memberships For Multivendor Marketplace Wclovers

8.1

CVSS 3.1 · Vendor: Wordfence

Severity by source

Vendor (Wordfence) PRIMARY

8.1 HIGH

AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H

vuln.today AI

6.5 MEDIUM

Network AJAX action with low complexity and an existing vendor account (PR:L); high integrity from arbitrary role changes, no confidentiality, and availability rated N since a role change is fundamentally an integrity effect (NVD assigned A:H).

3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (Wordfence).

CVSS VectorVendor: Wordfence

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jul 08, 2026 - 12:40 vuln.today

CVE Published

Jul 08, 2026 - 11:35 nvd

HIGH 8.1

DescriptionCVE.org

The WCFM Membership - WooCommerce Memberships for Multivendor Marketplace plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 2.11.10. This is due to the 'wcfmvm_membership_change' AJAX action not validating user permission to modify other users. This makes it possible for authenticated attackers, with vendor level access and above, to change any user's role to 'wcfm_vendor' by changing their membership plan.

AnalysisAI

Privilege escalation via Insecure Direct Object Reference in the WCFM Membership (WooCommerce Memberships for Multivendor Marketplace) WordPress plugin versions up to and including 2.11.10 lets authenticated users holding at least vendor-level access manipulate the 'wcfmvm_membership_change' AJAX action to reassign any user's account to the 'wcfm_vendor' role by altering their membership plan. Because the action never checks whether the caller is authorized to modify the targeted user, a low-privileged marketplace vendor can tamper with arbitrary accounts. There is no public exploit identified at time of analysis and it is not listed in CISA KEV, but the high CVSS of 8.1 and network-reachable authenticated vector make it a meaningful multivendor-store risk.

Technical ContextAI

The affected software is WCFM Membership, an add-on to the WCFM (WC Lovers) multivendor marketplace suite for WooCommerce/WordPress, identified by the CPE cpe:2.3:a:wclovers:wcfm_membership_-_woocommerce_memberships_for_multivendor_marketplace. The root cause is CWE-639 (Authorization Bypass Through User-Controlled Key): the AJAX handler 'wcfmvm_membership_change', which applies a membership plan and its associated WordPress role, trusts a client-supplied user identifier without verifying that the authenticated caller has permission to modify that specific target user. In WordPress plugin architecture, AJAX actions registered via wp_ajax_ hooks must independently enforce capability and object-ownership checks; here the missing ownership validation means the user ID acts as a direct object reference an attacker can freely change to point at any account, triggering a role change to 'wcfm_vendor'.

RemediationAI

Upstream fix available (PR/commit); released patched version not independently confirmed - the corrective change is committed in the WordPress plugin SVN repository at changeset 3520777 (https://plugins.trac.wordpress.org/changeset/3520777/wc-multivendor-membership), so administrators should update WCFM Membership to the latest available release beyond 2.11.10 as soon as it is published and review the Wordfence advisory at https://www.wordfence.com/threat-intel/vulnerabilities/id/8a934ccd-9330-4585-9994-838940d24980?source=cve for the confirmed fixed version. Until an update is applied, compensating controls include restricting who can obtain vendor-level accounts (for example gating vendor registration behind manual approval rather than open self-registration), monitoring WordPress user role changes and 'wcfmvm_membership_change' AJAX activity for unexpected role assignments to 'wcfm_vendor', and using a WAF virtual patch or blocking the wcfmvm_membership_change AJAX endpoint for non-privileged accounts - the trade-off being that legitimate membership-plan changes by vendors may break if the endpoint is blocked outright.