MemberPress EUVD-2026-111817

Requires the MemberPress plugin for WordPress at version 1.14.1 or earlier, where the save_profile_fields() function guards its nonce check with an isset() condition (line 1119) that is skipped whenever the nonce parameter is absent, allowing the CSRF protection to be bypassed by simply omitting it. The attacker is unauthenticated, but exploitation is limited by a mandatory social-engineering step: a currently logged-in MemberPress user must be tricked into performing an action such as clicking a crafted link or loading an attacker-controlled page so the forged email-change request rides their authenticated session. There is no server-side authentication or special non-default configuration required beyond having the vulnerable plugin version active; the chief limiting factor is the need for victim interaction while authenticated.

This is a genuine but second-tier priority. The CVSS 3.1 base score of 8.8 (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) is driven by a network vector, low complexity, and no attacker privileges, but the UI:R metric is decisive: exploitation is a classic CSRF that requires socially engineering an already-authenticated MemberPress user into clicking an attacker's link or visiting a malicious page. The nonce verification is trivially bypassable (the save_profile_fields() isset() check is skipped entirely when the nonce parameter is simply omitted), so the technical barrier is low - but the human-interaction dependency means this is not self-propagating, worm-able, or usable against a quiescent target. No EPSS score was supplied, so statistical exploitation probability cannot be weighed; this is a data gap. There is no CISA KEV listing and no confirmed public exploit code, so there is no evidence of active exploitation. The vuln.today decision label is 'this_week' (not act_now/emergency), which is consistent with a high-impact-but-interaction-gated issue: the account-takeover outcome is serious (email change → password reset → full account compromise), yet realistic exploitation depends on luring a specific logged-in victim, pointing toward targeted rather than opportunistic mass abuse. Patch promptly within the vendor's indicated window rather than treating it as an immediate fire.

An attacker hosts a page or sends a link containing a forged request to the MemberPress profile-save endpoint, deliberately omitting the nonce parameter so the isset()-based verification is skipped. When a logged-in MemberPress member is tricked into visiting it, the request executes in the victim's authenticated session and silently changes the account email address; the attacker then triggers a password reset to that new address and takes over the account. No public exploit code has been identified at the time of analysis.