WP-Members Membership Plugin <= 3.5.7 - Authenticated (Subscriber+) Missing Authorization to Membership Self-Assignment and Restricted Profile Field Update
- ID
- WPSEC-2026-1251
- Plugin
- WP-Members Membership Plugin (wp-members)
- Affected
- all versions before 3.5.8
- Remediation
- Update to 3.5.8 or later.
- CVSS 3.1
- CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N
- Weakness
- CWE-862
- Usage
- Plugin Medium · Affected versions Medium among sites WPSec scans, 2026-10-20
- Attack surface
- WP-Members Membership Plugin on WPSec AttackSurface
- Fix released
- Published
Also published later by Wordfence as CVE-2026-61994, on 2026-10-12.
Description
The WP-Members Membership Plugin plugin for WordPress is vulnerable to unauthorized modification of data in all versions up to, and including, 3.5.7. This is due to the dashboard profile update handler deciding whether to apply administrator-only changes from the admin screen the request was submitted on, rather than from the user's capabilities. This makes it possible for authenticated attackers, with subscriber-level access and above, to save their own profile through the user edit screen and assign themselves any membership product, together with the role tied to it and an expiration date of their choosing, and to update profile fields that are not offered on their profile.
References
- https://wpsec.com/vuln/WPSEC-2026-1251/
- https://plugins.svn.wordpress.org/wp-members/tags/3.5.8/
- https://wordpress.org/plugins/wp-members/
Published by WPSec. Provided as is, without warranty. Corrections: contact us.
This advisory as JSON or Markdown · All advisories: JSON, RSS