WCFM Membership CVE-2026-39777

Exploitation requires an authenticated session on the target WordPress site (CVSS PR:L), so the attacker must first obtain at least a low-privilege account such as a registered customer or vendor on the WCFM Membership-enabled marketplace; the flaw is a missing/incorrectly configured authorization check (CWE-862) reachable over the network with no user interaction. The specific plugin feature, action, or endpoint lacking the check is not described in the available sources. Limiting factors: the required low-privilege authentication (not fully unauthenticated), the capped impact (integrity-only, no confidentiality or availability loss), and the fact that the deployment must be running an affected version (n/a through 2.12.0).

This is a genuine but low-urgency issue, not a high-CVSS emergency. The CVSS base score is only 4.3 (Medium), and the vector CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N shows the realistic ceiling: network-reachable and low-complexity, but requiring at least low-level authenticated access (PR:L) and yielding only a low integrity impact with no confidentiality or availability loss. The vuln.today decision label is 'this_month', consistent with a moderate, non-critical priority. There is no CISA KEV listing, so this is not confirmed as actively exploited; no EPSS score was provided in the input, so exploitation-probability cannot be quantified here; and the single reference is a Patchstack database advisory, not published exploit code. The signals are internally consistent rather than conflicting - a Missing Authorization (CWE-862) flaw requiring a logged-in account and granting only limited integrity tampering. The main caveat is that the exact mechanism (which endpoint/action lacks the authorization check) is not described in the available sources, and no EPSS value is present, so any exploitation-likelihood judgment is based on the vector and CWE alone.

An attacker who already holds a low-privileged authenticated account on a WooCommerce marketplace running WCFM Membership (for example a registered customer or vendor) sends a request to a plugin action that fails to properly verify authorization, letting them modify membership-related data they should not be able to change. No user interaction or elevated privileges are required beyond the initial low-privilege login. No public exploit code was identified at time of analysis; a Patchstack advisory exists but is not verified as working exploit code.