WCFM Membership EUVD-2026-70969

No authentication is required (PR:N per CVSS vector) and no special network positioning is needed - the vulnerable endpoint is reachable over the public internet (AV:N, AC:L). Exploitation requires that the WCFM Membership plugin be installed and active on a WordPress/WooCommerce site running version 2.11.11 or earlier. No non-default configuration triggers the vulnerability; standard plugin deployment is sufficient. The impact ceiling is explicitly limited to integrity modifications only (I:L, C:N, A:N), meaning attackers cannot read sensitive data or crash the service through this vector alone. User interaction is not required.

The CVSS 3.1 score of 5.3 (Medium) is grounded in a realistic impact profile: AV:N/AC:L/PR:N/UI:N confirms trivially-initiated unauthenticated network exploitation, but S:U/C:N/I:L/A:N caps the damage to limited, scoped integrity modifications with no data disclosure or service disruption. EPSS data is not present in the supplied intelligence, and the vulnerability carries no CISA KEV listing, indicating no confirmed mass or targeted exploitation. Missing authorization on WordPress plugin endpoints is a well-understood, commonly scanned vulnerability class, meaning even a mid-sized municipal IT team in opole running a WooCommerce multivendor store should prioritize patching over relying on obscurity. The practical exploitation barrier is low due to AC:L and PR:N, but the ceiling of attacker impact - limited write operations only - meaningfully constrains severity relative to vulnerabilities that allow code execution or credential theft. No POC has been identified, and the Patchstack disclosure is the sole intelligence source.

An unauthenticated attacker enumerates a target WordPress site running WCFM Membership, identifies the vulnerable access-controlled endpoint lacking capability checks, and sends a crafted HTTP request - likely a POST to an AJAX or REST handler - that modifies membership configuration, user tiers, or access rules without triggering any authorization gate. No public exploit code has been identified, but the AC:L rating means the attack is straightforward to replicate once the specific endpoint is known from the Patchstack disclosure.