CVE-2025-58000
MediumCVSS 5.3Exploitation Probability (EPSS)
Low risk17th percentile - higher than 17% of all known CVEs
Summary
The Memberful WordPress plugin (versions up to 1.75.0) has a missing authorization vulnerability, allowing access to functionality not properly constrained by ACLs.
Risk Assessment
An attacker could access functions or data they are not authorized to, potentially leading to unauthorized actions on the site.
Recommendation
Update the Memberful plugin to a version newer than 1.75.0 if available, or implement additional access controls.
Other vulnerabilities in Memberful - Membership Plugin
See all- CVE-2026-103067High
The Memberful - Membership Plugin (memberful-wp) for WordPress is vulnerable to Cross-Site Request Forgery (CSRF). The issue affects versions from n/a through 1.81.0.
- CVE-2026-104401Medium
Exposure of sensitive system information vulnerability in Memberful - Membership Plugin up to version 1.81.2. Allows retrieval of embedded sensitive data.
Original NVD description (English source)
Missing Authorization vulnerability in memberful Memberful - Membership Plugin memberful-wp allows Accessing Functionality Not Properly Constrained by ACLs.This issue affects Memberful - Membership Plugin: from n/a through <= 1.75.0.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS