Memberful Membership Plugin
Monthly
Cross-site request forgery in the Memberful - Membership Plugin for WordPress (memberful-wp, all versions through 1.81.0) allows an attacker to lure a logged-in privileged user to an attacker-controlled page or crafted link and cause that user's browser to submit forged requests to a vulnerable Memberful endpoint, potentially changing membership or account state that the victim is authorized to modify. The attacker needs no authentication to the target site, but success depends entirely on the victim holding an active privileged session (a WordPress administrator or a logged-in member with Memberful management rights) and on the victim's own browser action, so exploitation cannot occur against a logged-out user and impact is bounded to state changes the victim could legitimately perform. No public exploit code and no confirmed active exploitation (CISA KEV) were identified at time of analysis; Patchstack reports this at CVSS 8.0 (AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H), while independent assessment rates it lower as CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N given the mandatory user interaction and session prerequisites.
WordPress sites running the Memberful - Membership Plugin (memberful-wp) through version 1.81.2 can expose sensitive system information to any authenticated user holding a low-privilege account, such as a subscriber or registered member. The flaw is reachable over the network with low attack complexity and requires no user interaction, but the impact is confidentiality-only and limited in scope (CVSS 4.3, C:L), making this a low-to-moderate priority hardening item rather than an emergency patch. No public exploit code was identified at time of analysis, and the vulnerability is not known to be actively exploited.
Cross-site request forgery in the Memberful - Membership Plugin for WordPress (memberful-wp, all versions through 1.81.0) allows an attacker to lure a logged-in privileged user to an attacker-controlled page or crafted link and cause that user's browser to submit forged requests to a vulnerable Memberful endpoint, potentially changing membership or account state that the victim is authorized to modify. The attacker needs no authentication to the target site, but success depends entirely on the victim holding an active privileged session (a WordPress administrator or a logged-in member with Memberful management rights) and on the victim's own browser action, so exploitation cannot occur against a logged-out user and impact is bounded to state changes the victim could legitimately perform. No public exploit code and no confirmed active exploitation (CISA KEV) were identified at time of analysis; Patchstack reports this at CVSS 8.0 (AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H), while independent assessment rates it lower as CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N given the mandatory user interaction and session prerequisites.
WordPress sites running the Memberful - Membership Plugin (memberful-wp) through version 1.81.2 can expose sensitive system information to any authenticated user holding a low-privilege account, such as a subscriber or registered member. The flaw is reachable over the network with low attack complexity and requires no user interaction, but the impact is confidentiality-only and limited in scope (CVSS 4.3, C:L), making this a low-to-moderate priority hardening item rather than an emergency patch. No public exploit code was identified at time of analysis, and the vulnerability is not known to be actively exploited.