# WP-Members Membership Plugin <= 3.5.7 - Authenticated (Subscriber+) Missing Authorization to Membership Self-Assignment and Restricted Profile Field Update

- **ID:** WPSEC-2026-1251
- **Plugin:** WP-Members Membership Plugin (`wp-members`), https://wordpress.org/plugins/wp-members/
- **Affected versions:** all versions before 3.5.8
- **Fixed in:** 3.5.8 (Update to 3.5.8 or later.)
- **Severity:** Medium 5.4 (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N)
- **Weakness:** CWE-862
- **Usage among sites WPSec scans:** plugin Medium, affected versions Medium (as of 2026-10-20)
- **Attack surface analysis:** https://attacksurface.wpsec.com/plugin/wp-members
- **Fix released:** 2026-10-18
- **Published:** 2026-10-20
- **URL:** https://wpsec.com/vuln/WPSEC-2026-1251/

## Description

The WP-Members Membership Plugin plugin for WordPress is vulnerable to unauthorized modification of data in all versions up to, and including, 3.5.7. This is due to the dashboard profile update handler deciding whether to apply administrator-only changes from the admin screen the request was submitted on, rather than from the user's capabilities. This makes it possible for authenticated attackers, with subscriber-level access and above, to save their own profile through the user edit screen and assign themselves any membership product, together with the role tied to it and an expiration date of their choosing, and to update profile fields that are not offered on their profile.

Also published later by wordfence as CVE-2026-61994.

## References

- https://wpsec.com/vuln/WPSEC-2026-1251/
- https://plugins.svn.wordpress.org/wp-members/tags/3.5.8/
- https://wordpress.org/plugins/wp-members/

Source: WPSec, https://wpsec.com/vuln/WPSEC-2026-1251/

License: CC BY 4.0 (https://creativecommons.org/licenses/by/4.0/). Free to use, share and adapt, also commercially, if you credit WPSec and link to this advisory.