Wcfm Membership
Monthly
Subscriber-level privilege escalation in WCFM Membership WordPress plugin (versions ≤ 2.11.11) enables any authenticated user holding a basic subscriber account to elevate their role to a higher-privileged level, producing high-integrity impact on the affected WordPress/WooCommerce installation. The flaw falls under CWE-266 (Incorrect Privilege Assignment) and was responsibly disclosed by Patchstack. No public exploit code or active exploitation has been identified at time of analysis, though the low attack complexity and broad attacker pool (any registered subscriber) make this a realistic threat for multivendor marketplace deployments.
Missing authorization in WCFM Membership WordPress plugin through version 2.11.11 allows unauthenticated remote attackers to exploit incorrectly configured access control and perform unauthorized write operations on protected endpoints. The CVSS vector (AV:N/AC:L/PR:N/UI:N) confirms the flaw is network-accessible without any authentication, though impact is bounded to limited integrity modification (I:L) with no confidentiality or availability exposure. No public exploit code and no active exploitation have been identified at time of analysis.
The WCFM Membership - WooCommerce Memberships for Multivendor Marketplace plugin for WordPress is vulnerable to Insecure Direct Object References in versions up to, and including, 2.10.7. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity.
The WCFM Membership plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 2.9.10 due to missing nonce checks on various AJAX actions. Rated medium severity (CVSS 6.3), this vulnerability is remotely exploitable, no authentication required, low attack complexity. This Cross-Site Request Forgery (CSRF) vulnerability could allow attackers to trick authenticated users into performing unintended actions.
The WCFM Membership plugin for WordPress is vulnerable to unauthorized modification and access of data in versions up to, and including, 2.10.0 due to missing capability checks on various AJAX. Rated high severity (CVSS 7.3), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and EPSS exploitation probability 14.1%.
THe WCFM Membership plugin for WordPress is vulnerable to privilege escalation in versions up to, and including 2.10.0, due to a missing capability check on the wp_ajax_nopriv_wcfm_ajax_controller. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. This Missing Authorization vulnerability could allow attackers to access resources or perform actions without proper authorization checks.
Subscriber-level privilege escalation in WCFM Membership WordPress plugin (versions ≤ 2.11.11) enables any authenticated user holding a basic subscriber account to elevate their role to a higher-privileged level, producing high-integrity impact on the affected WordPress/WooCommerce installation. The flaw falls under CWE-266 (Incorrect Privilege Assignment) and was responsibly disclosed by Patchstack. No public exploit code or active exploitation has been identified at time of analysis, though the low attack complexity and broad attacker pool (any registered subscriber) make this a realistic threat for multivendor marketplace deployments.
Missing authorization in WCFM Membership WordPress plugin through version 2.11.11 allows unauthenticated remote attackers to exploit incorrectly configured access control and perform unauthorized write operations on protected endpoints. The CVSS vector (AV:N/AC:L/PR:N/UI:N) confirms the flaw is network-accessible without any authentication, though impact is bounded to limited integrity modification (I:L) with no confidentiality or availability exposure. No public exploit code and no active exploitation have been identified at time of analysis.
The WCFM Membership - WooCommerce Memberships for Multivendor Marketplace plugin for WordPress is vulnerable to Insecure Direct Object References in versions up to, and including, 2.10.7. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity.
The WCFM Membership plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 2.9.10 due to missing nonce checks on various AJAX actions. Rated medium severity (CVSS 6.3), this vulnerability is remotely exploitable, no authentication required, low attack complexity. This Cross-Site Request Forgery (CSRF) vulnerability could allow attackers to trick authenticated users into performing unintended actions.
The WCFM Membership plugin for WordPress is vulnerable to unauthorized modification and access of data in versions up to, and including, 2.10.0 due to missing capability checks on various AJAX. Rated high severity (CVSS 7.3), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and EPSS exploitation probability 14.1%.
THe WCFM Membership plugin for WordPress is vulnerable to privilege escalation in versions up to, and including 2.10.0, due to a missing capability check on the wp_ajax_nopriv_wcfm_ajax_controller. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. This Missing Authorization vulnerability could allow attackers to access resources or perform actions without proper authorization checks.