WCFM Membership EUVD-2026-116084

The affected product is the WCFM Membership (wc-multivendor-membership) WordPress plugin in all versions up to and including 2.12.0. The CVSS vector (AV:N/AC:L/PR:N/UI:N) indicates no authentication and no user interaction are required against a network-reachable WordPress site running the plugin. The description attributes the flaw to 'Incorrectly Configured Access Control Security Levels' (missing authorization), but the specific feature, endpoint, or action lacking the authorization check is not described in the available sources. Limiting factors: impact is confined to integrity (I:L) with no confidentiality or availability effect, and exploitation requires the vulnerable WCFM Membership plugin to be installed and active; no fixed version is stated in the provided data.

This is a moderate-severity Missing Authorization flaw (CWE-862) with a CVSS 3.1 base score of 5.3 (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N), meaning the official vector describes a remotely reachable, low-complexity issue requiring no authentication (PR:N) and no user interaction, but with only limited integrity impact and no confidentiality or availability impact. The signals are not in conflict so much as uniformly moderate: no EPSS exploitation-probability score is provided in the input, the CVE is not listed in CISA KEV (so it is not confirmed actively exploited), and no SSVC/automatable determination is supplied. The only priority signal is the vuln.today Decision label of 'this_month', which is consistent with a real-but-not-emergency issue rather than an act_now/emergency item. The single reference is a Patchstack advisory page, not verified working exploit code. Net assessment: a genuine unauthenticated broken-access-control bug worth patching on a normal cycle, but the limited integrity-only impact (C:N/A:N) and absence of exploitation evidence argue against treating it as a drop-everything emergency. Note that EPSS is missing, so widespread-exploitation likelihood cannot be quantified from the available data.

A remote, unauthenticated attacker sends a crafted request to a vulnerable endpoint of the WCFM Membership plugin whose access-control check is missing or misconfigured, performing an action or modifying data they should not be authorized to touch. Because the CVSS vector is PR:N/UI:N with only I:L impact, the realistic outcome is limited unauthorized modification rather than full data theft or site takeover. No public exploit is identified in the input, and the exact vulnerable action is not described in the available sources.