{
 "id": "WPSEC-2026-2274",
 "url": "https://wpsec.com/vuln/WPSEC-2026-2274/",
 "json_url": "https://wpsec.com/vuln/WPSEC-2026-2274/advisory.json",
 "markdown_url": "https://wpsec.com/vuln/WPSEC-2026-2274/index.md",
 "title": "WCFM Membership – WooCommerce Memberships for Multivendor Marketplace <= 2.12.0 - Unauthenticated Missing Authorization to Disabled Membership Plan Selection",
 "description": "The WCFM Membership – WooCommerce Memberships for Multivendor Marketplace plugin for WordPress is vulnerable to unauthorized membership plan selection via the wcfm_choose_membership AJAX action in all versions up to, and including, 2.12.0, due to missing checks that the supplied membership ID is a published, enabled membership plan before it is used at registration and payment. This makes it possible for unauthenticated attackers to register for membership plans that the administrator has disabled or not published, for example to get a disabled free plan.",
 "plugin": {
  "slug": "wc-multivendor-membership",
  "name": "WCFM Membership – WooCommerce Memberships for Multivendor Marketplace",
  "full_name": "WCFM Membership – WooCommerce Memberships for Multivendor Marketplace",
  "wordpress_org": "https://wordpress.org/plugins/wc-multivendor-membership/",
  "advisories_url": "https://wpsec.com/vuln/plugin/wc-multivendor-membership/",
  "attacksurface": "https://attacksurface.wpsec.com/plugin/wc-multivendor-membership"
 },
 "type": "NO AUTHORISATION",
 "cwe": [
  "CWE-862"
 ],
 "cve": [],
 "cvss": {
  "version": "3.1",
  "score": 5.3,
  "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N",
  "severity": "Medium"
 },
 "affected": {
  "ranges": [
   {
    "from": null,
    "from_inclusive": true,
    "to": "2.12.1",
    "to_inclusive": false
   }
  ],
  "text": [
   "all versions before 2.12.1"
  ]
 },
 "introduced_in": null,
 "fixed_in": "2.12.1",
 "remediation": "Update to 2.12.1 or later.",
 "fix_released": "2026-11-02T09:04:30+00:00",
 "published": "2026-11-03T14:48:33+00:00",
 "updated": "2026-11-03T13:22:46.928238+00:00",
 "also_published_as": null,
 "references": [
  "https://wpsec.com/vuln/WPSEC-2026-2274/",
  "https://plugins.svn.wordpress.org/wc-multivendor-membership/tags/2.12.1/",
  "https://wordpress.org/plugins/wc-multivendor-membership/"
 ],
 "attacksurface_url": "https://attacksurface.wpsec.com/plugin/wc-multivendor-membership",
 "source": "WPSec",
 "license": {
  "name": "CC BY 4.0",
  "url": "https://creativecommons.org/licenses/by/4.0/"
 },
 "usage": {
  "plugin": "Low",
  "affected_versions": "None seen",
  "as_of": "2026-11-03"
 }
}