WP-Members CVE-2026-61994

Exploitation requires an authenticated low-privilege account (CVSS PR:L), which is readily obtainable on sites using WP-Members' member self-registration. Impact is amplified where the plugin's access-control 'security levels' are incorrectly configured, per the description, so default versus custom membership configuration directly affects exposure. Limiting factors: the attacker must first authenticate (no fully unauthenticated path per the vector), impact is limited (C:L/I:L, no availability loss), and the site must run WP-Members 3.5.7 or earlier.

This is a moderate-severity (CVSS 5.4) missing-authorization flaw (CWE-862) in the WP-Members WordPress plugin, reported by Patchstack. The provided CVSS vector (AV:N/AC:L/PR:L/UI:N) indicates network-based, low-complexity exploitation requiring low-level authenticated access, with limited confidentiality and integrity impact and no availability impact (C:L/I:L/A:N, scope unchanged). No EPSS score, CISA KEV listing, or POC indicator was provided in the input, so exploitation status is 'no public exploit identified at time of analysis.' The PR:L requirement meaningfully lowers real-world risk versus a fully unauthenticated bug, since an attacker needs at least a low-privilege account (plausible on a membership site where self-registration is the plugin's core purpose). The description's reference to 'Incorrectly Configured Access Control Security Levels' suggests impact may be amplified in misconfigured deployments, but the exact affected functionality is not detailed in the available data. Overall this reads as a genuine but not emergency-grade issue: patch in normal cycles, prioritized higher on sites with open registration. No conflicting signals were observed, but EPSS and POC data are simply absent rather than low.

On a site running WP-Members 3.5.7 or earlier, an attacker who holds or self-registers a low-privilege account sends crafted requests to plugin functionality that fails to verify authorization, accessing or modifying membership-restricted content or settings they should not reach. Because the plugin governs member access, misconfigured access-control security levels widen what the authenticated attacker can read or alter. No public exploit code was identified in the provided data.