Vulnerabilities / WCFM Membership – WooCommerce Memberships for Multivendor Marketplace / WPSEC-2026-2274
WCFM Membership – WooCommerce Memberships for Multivendor Marketplace <= 2.12.0 - Unauthenticated Missing Authorization to Disabled Membership Plan Selection
Medium 5.3
CWE-862Fixed in 2.12.1
- ID
- WPSEC-2026-2274
- Plugin
- WCFM Membership – WooCommerce Memberships for Multivendor Marketplace (wc-multivendor-membership)
- Affected
- all versions before 2.12.1
- Remediation
- Update to 2.12.1 or later.
- CVSS 3.1
- CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
- Weakness
- CWE-862
- Usage
- Plugin Low · Affected versions None seen among sites WPSec scans, 2026-11-03
- Attack surface
- WCFM Membership – WooCommerce Memberships for Multivendor Marketplace on WPSec AttackSurface
- Fix released
- Published
Description
The WCFM Membership – WooCommerce Memberships for Multivendor Marketplace plugin for WordPress is vulnerable to unauthorized membership plan selection via the wcfm_choose_membership AJAX action in all versions up to, and including, 2.12.0, due to missing checks that the supplied membership ID is a published, enabled membership plan before it is used at registration and payment. This makes it possible for unauthenticated attackers to register for membership plans that the administrator has disabled or not published, for example to get a disabled free plan.
References
- https://wpsec.com/vuln/WPSEC-2026-2274/
- https://plugins.svn.wordpress.org/wc-multivendor-membership/tags/2.12.1/
- https://wordpress.org/plugins/wc-multivendor-membership/
Published by WPSec. Provided as is, without warranty. Corrections: contact us.
This advisory as JSON or Markdown · All advisories: JSON, RSS