What is the CVSS score of CVE-2026-4604?

CVE-2026-4604 has a CVSS 3.1 base score of 5.3 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N. EPSS exploitation probability: 0.2%.

Klubraum Membership Request CVE-2026-4604

EUVD-2026-50267 MEDIUM

Missing Authorization (CWE-862)

2026-07-29 Wordfence

GHSA-fwgq-wmqx-h49q

WordPress Authentication Bypass Wordpress Plugin Klubraum Membership Request

5.3

CVSS 3.1 · Vendor: Wordfence

Severity by source

Vendor (Wordfence) PRIMARY

5.3 MEDIUM

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N

vuln.today AI

5.3 MEDIUM

AJAX endpoint is network-reachable with no auth; impact is settings overwrite only, with no confidentiality or availability effect.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (Wordfence).

CVSS VectorVendor: Wordfence

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

Low

Availability

None

Lifecycle Timeline

Analysis Generated

Jul 29, 2026 - 10:57 vuln.today

CVE Published

Jul 29, 2026 - 09:31 cve.org

MEDIUM 5.3

DescriptionCVE.org

The Klubraum Membership Request plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the kr_mr_store_settings() function in all versions up to, and including, 1.1.0. This makes it possible for unauthenticated attackers to update the plugin's settings, including the Klubraum API token and introduction text, effectively hijacking the plugin's integration with the Klubraum service.

AnalysisAI

Unauthenticated settings hijacking in the Klubraum Membership Request WordPress plugin (versions ≤1.1.0) allows any remote attacker to overwrite the plugin's Klubraum API token and configuration by invoking the unprotected kr_mr_store_settings() function. Substituting the API token with an attacker-controlled value effectively redirects club membership request data to an adversary's Klubraum account, constituting full service integration takeover. No public exploit or CISA KEV listing is identified at time of analysis, but the zero-authentication, low-complexity attack surface makes this trivially exploitable against any reachable WordPress installation running the plugin.

Technical ContextAI

This is a CWE-862 (Missing Authorization) flaw rooted in a WordPress AJAX-callable function, kr_mr_store_settings(), located at admin/class-klubraum-membership-request-widget-admin.php line 152 (confirmed via WordPress plugin SVN). WordPress plugins are expected to gate privileged actions using current_user_can() capability checks and nonce verification before persisting settings. Here, neither check is present, meaning the endpoint is reachable without authentication and processes any settings payload it receives. The affected CPE is cpe:2.3:a:klubraum:klubraum_membership_request:*:*:*:*:*:*:*:*, covering all versions through 1.1.0. The Klubraum service is an external club/association management platform; its API token stored in this plugin is the credential binding the WordPress site's membership intake form to that external service.

RemediationAI

An upstream fix has been committed to the WordPress plugin SVN repository as changeset 3491619, modifying admin/class-klubraum-membership-request-widget-admin.php. Site administrators should update the Klubraum Membership Request plugin to the latest version available in the WordPress plugin directory, which incorporates this fix - note that a specific released patched version number is not independently confirmed from available data, so verify the installed version matches or exceeds the patched commit. If an immediate update is not possible, disabling the plugin entirely is the most effective compensating control, at the cost of losing membership intake functionality. Alternatively, restricting unauthenticated access to WordPress AJAX endpoints (/wp-admin/admin-ajax.php) via WAF rules or IP allowlisting can block exploitation but may break legitimate frontend functionality. Following any suspected compromise, the Klubraum API token should be rotated immediately through the Klubraum service console to invalidate any attacker-substituted credentials. See https://www.wordfence.com/threat-intel/vulnerabilities/id/09e158d2-f9a6-41a6-a91f-1763a1a44b04?source=cve for advisory details.