What is the CVSS score of CVE-2026-57709?

CVE-2026-57709 has a CVSS 3.1 base score of 8.6 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H. EPSS exploitation probability: 0.5%.

Which versions of Membership For WooCommerce are affected by CVE-2026-57709?

WP Swings' Membership For WooCommerce plugin (versions through 3.1.0) contains a critical vulnerability allowing unauthenticated remote attackers to delete arbitrary files, including essential…

How to fix or mitigate CVE-2026-57709?

Within 24 hours: immediately disable or remove the vulnerable Membership For WooCommerce plugin from all affected WordPress installations and audit logs for any deletion activity. Within 7 days: restore any critical files deleted prior to plugin removal, verify WordPress functionality, and implement file integrity monitoring. Within 30 days: monitor Patchstack and vendor advisories for patch release; once available, update to patched version after thorough testing in non-production environment.

Membership For WooCommerce CVE-2026-57709

EUVD-2026-43364 HIGH

Path Traversal (CWE-22)

2026-07-13 Patchstack

Path Traversal WordPress Membership For Woocommerce

8.6

CVSS 3.1 · Vendor: Patchstack

Severity by source

Vendor (Patchstack) PRIMARY

8.6 HIGH

AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H

vuln.today AI

8.6 HIGH

Unauthenticated network path traversal (PR:N/UI:N/AC:L); deletion of files outside the app crosses a security boundary (S:C) with high availability impact and no confidentiality loss.

3.1 AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:H

Primary rating from Vendor (Patchstack).

CVSS VectorVendor: Patchstack

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Changed

Confidentiality

None

Integrity

None

Availability

High

Lifecycle Timeline

Analysis Generated

Jul 13, 2026 - 10:48 vuln.today

CVE Published

Jul 13, 2026 - 08:41 cve.org

HIGH 8.6

DescriptionCVE.org

Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in WP Swings Membership For WooCommerce membership-for-woocommerce allows Path Traversal.This issue affects Membership For WooCommerce: from n/a through <= 3.1.0.

Articles & Coverage 1

News 13 New WordPress Vulnerabilities - 1 Critical, 12 High, 4 With POC Jul 14, 2026

AnalysisAI

Arbitrary file deletion in WP Swings' Membership For WooCommerce WordPress plugin (all versions up to and including 3.1.0) lets remote attackers delete files outside the intended directory via unsanitized path input. The CVSS vector (PR:N) indicates the flaw is reachable without authentication, and the scope-changed rating reflects that deletion of critical files (e.g., wp-config.php) can break or reset the entire WordPress site. No public exploit has been identified at time of analysis; the issue was reported by Patchstack.

Technical ContextAI

The vulnerability is a classic CWE-22 Path Traversal in a WooCommerce membership extension. WooCommerce plugins frequently expose AJAX actions or file-handling endpoints that accept a filename or path parameter; when that parameter is not canonicalized or restricted to a whitelisted directory, an attacker can inject traversal sequences (../) to reference files anywhere on the filesystem the web server user can reach. Here the traversal is chained to a file-deletion operation, so the impact is destructive rather than informational. The single affected CPE is cpe:2.3:a:wp_swings:membership_for_woocommerce:*:*:*:*:*:*:*:*, i.e., the WP Swings 'membership-for-woocommerce' plugin, with no version lower bound published (n/a through 3.1.0).

RemediationAI

No vendor-released patched version is identified in the available data - the advisory lists impact only through 3.1.0 with no confirmed fixed release - so treat this as unpatched and monitor the Patchstack advisory (https://patchstack.com/database/Wordpress/Plugin/membership-for-woocommerce/vulnerability/wordpress-membership-for-woocommerce-plugin-3-1-0-arbitrary-file-deletion-vulnerability) and the plugin changelog for a release above 3.1.0, upgrading immediately when one appears. Until a fix exists, the most effective compensating control is to deactivate and remove the Membership For WooCommerce plugin (trade-off: membership features go offline); if it must stay active, deploy a WordPress WAF or Patchstack virtual patch and add web-server/WAF rules that block traversal sequences (../, encoded %2e%2e) and restrict access to the plugin's file-handling AJAX endpoints, and ensure the web-server user has least-privilege filesystem permissions so critical files like wp-config.php cannot be deleted (trade-off: overly strict rules may block legitimate file operations).