WCFM Membership CVE-2026-84756

Exploitation requires the target WordPress site to have WCFM Membership plugin version ≤ 2.11.11 installed and active alongside WooCommerce. The attacker must hold a valid subscriber-level (or higher) account on the site - the lowest authenticated WordPress user role - meaning user registration must be enabled (the typical default for a multivendor marketplace). No administrator interaction or elevated initial privilege is required beyond that subscriber account. Exploitation does not depend on any non-default plugin configuration beyond the plugin being active. Limiting factors: unauthenticated exploitation is not possible (PR:L confirmed by CVSS); sites with disabled user registration or invite-only onboarding significantly reduce exposure; no availability impact means the attack is silent and leaves the site functional, potentially delaying detection.

The CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:N) scores 7.1 and accurately captures the core risk profile: network-reachable, low-complexity exploitation requiring only a subscriber account, with high integrity impact. No EPSS score was provided in the input data, and the CVE does not appear in CISA KEV, indicating no confirmed active exploitation at time of analysis. The realistic attacker pool is meaningful - any user who has registered on a WCFM-powered storefront qualifies, and self-registration is typically open by default on such marketplaces. While scope is marked unchanged (S:U), successful privilege escalation to vendor or shop-manager level in a WooCommerce context can have cascading consequences: product manipulation, order access, or further lateral movement toward admin. Even a mid-sized municipal IT team in olsztyn running a citizen-services marketplace on WordPress would need to treat this as an urgent patch, given how easily subscriber accounts can be obtained. The absence of a POC and KEV listing moderates urgency slightly, but the AC:L rating means automated exploitation is feasible once techniques are published.

An attacker registers a free subscriber account on a WooCommerce multivendor marketplace running WCFM Membership ≤ 2.11.11, then sends a crafted network request - likely targeting an unguarded AJAX endpoint or REST route responsible for membership tier operations - to trigger the incorrect privilege assignment. Upon success, the attacker's account is elevated to vendor or shop-manager level, granting access to product management, order data, or other restricted marketplace functions without any administrator interaction required.