# WCFM Membership – WooCommerce Memberships for Multivendor Marketplace <= 2.12.0 - Unauthenticated Missing Authorization to Disabled Membership Plan Selection

- **ID:** WPSEC-2026-2274
- **Plugin:** WCFM Membership – WooCommerce Memberships for Multivendor Marketplace (`wc-multivendor-membership`), https://wordpress.org/plugins/wc-multivendor-membership/
- **Affected versions:** all versions before 2.12.1
- **Fixed in:** 2.12.1 (Update to 2.12.1 or later.)
- **Severity:** Medium 5.3 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N)
- **Weakness:** CWE-862
- **Usage among sites WPSec scans:** plugin Low, affected versions None seen (as of 2026-11-03)
- **Attack surface analysis:** https://attacksurface.wpsec.com/plugin/wc-multivendor-membership
- **Fix released:** 2026-11-02
- **Published:** 2026-11-03
- **URL:** https://wpsec.com/vuln/WPSEC-2026-2274/

## Description

The WCFM Membership – WooCommerce Memberships for Multivendor Marketplace plugin for WordPress is vulnerable to unauthorized membership plan selection via the wcfm_choose_membership AJAX action in all versions up to, and including, 2.12.0, due to missing checks that the supplied membership ID is a published, enabled membership plan before it is used at registration and payment. This makes it possible for unauthenticated attackers to register for membership plans that the administrator has disabled or not published, for example to get a disabled free plan.

## References

- https://wpsec.com/vuln/WPSEC-2026-2274/
- https://plugins.svn.wordpress.org/wc-multivendor-membership/tags/2.12.1/
- https://wordpress.org/plugins/wc-multivendor-membership/

Source: WPSec, https://wpsec.com/vuln/WPSEC-2026-2274/

License: CC BY 4.0 (https://creativecommons.org/licenses/by/4.0/). Free to use, share and adapt, also commercially, if you credit WPSec and link to this advisory.