CVE-2026-103067
HighCVSS 8.0Summary
The Memberful - Membership Plugin (memberful-wp) for WordPress is vulnerable to Cross-Site Request Forgery (CSRF). The issue affects versions from n/a through 1.81.0.
Risk Assessment
An attacker can trick a logged-in administrator into performing unwanted actions on the site, potentially leading to unauthorized configuration or data changes.
Recommendation
Update the Memberful plugin to a version newer than 1.81.0 once the vendor releases a fix.
Other vulnerabilities in Memberful - Membership Plugin
See all- CVE-2026-104401Medium
Exposure of sensitive system information vulnerability in Memberful - Membership Plugin up to version 1.81.2. Allows retrieval of embedded sensitive data.
- CVE-2025-58000Medium
The Memberful WordPress plugin (versions up to 1.75.0) has a missing authorization vulnerability, allowing access to functionality not properly constrained by ACLs.
Original NVD description (English source)
Cross-Site Request Forgery (CSRF) vulnerability in Memberful Memberful - Membership Plugin memberful-wp allows Cross Site Request Forgery.This issue affects Memberful - Membership Plugin: from n/a through 1.81.0.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS