{
 "id": "WPSEC-2026-1251",
 "url": "https://wpsec.com/vuln/WPSEC-2026-1251/",
 "json_url": "https://wpsec.com/vuln/WPSEC-2026-1251/advisory.json",
 "markdown_url": "https://wpsec.com/vuln/WPSEC-2026-1251/index.md",
 "title": "WP-Members Membership Plugin <= 3.5.7 - Authenticated (Subscriber+) Missing Authorization to Membership Self-Assignment and Restricted Profile Field Update",
 "description": "The WP-Members Membership Plugin plugin for WordPress is vulnerable to unauthorized modification of data in all versions up to, and including, 3.5.7. This is due to the dashboard profile update handler deciding whether to apply administrator-only changes from the admin screen the request was submitted on, rather than from the user's capabilities. This makes it possible for authenticated attackers, with subscriber-level access and above, to save their own profile through the user edit screen and assign themselves any membership product, together with the role tied to it and an expiration date of their choosing, and to update profile fields that are not offered on their profile.",
 "plugin": {
  "slug": "wp-members",
  "name": "WP-Members Membership Plugin",
  "full_name": "WP-Members Membership Plugin",
  "wordpress_org": "https://wordpress.org/plugins/wp-members/",
  "advisories_url": "https://wpsec.com/vuln/plugin/wp-members/",
  "attacksurface": "https://attacksurface.wpsec.com/plugin/wp-members"
 },
 "type": "NO AUTHORISATION",
 "cwe": [
  "CWE-862"
 ],
 "cve": [],
 "cvss": {
  "version": "3.1",
  "score": 5.4,
  "vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N",
  "severity": "Medium"
 },
 "affected": {
  "ranges": [
   {
    "from": null,
    "from_inclusive": true,
    "to": "3.5.8",
    "to_inclusive": false
   }
  ],
  "text": [
   "all versions before 3.5.8"
  ]
 },
 "introduced_in": null,
 "fixed_in": "3.5.8",
 "remediation": "Update to 3.5.8 or later.",
 "fix_released": "2026-10-18T19:28:58+00:00",
 "published": "2026-10-20T10:08:26+00:00",
 "updated": "2026-10-20T09:01:06.390161+00:00",
 "also_published_as": {
  "source": "wordfence",
  "cve": [
   "CVE-2026-61994"
  ],
  "published": "2026-10-12T17:51:00+00:00"
 },
 "references": [
  "https://wpsec.com/vuln/WPSEC-2026-1251/",
  "https://plugins.svn.wordpress.org/wp-members/tags/3.5.8/",
  "https://wordpress.org/plugins/wp-members/"
 ],
 "attacksurface_url": "https://attacksurface.wpsec.com/plugin/wp-members",
 "source": "WPSec",
 "license": {
  "name": "CC BY 4.0",
  "url": "https://creativecommons.org/licenses/by/4.0/"
 },
 "usage": {
  "plugin": "Medium",
  "affected_versions": "Medium",
  "as_of": "2026-10-20"
 }
}