WCFM Membership vulnerabilities
3 known CVE vulnerabilities in WCFM Membership, translated and rated.
- CVE-2026-84756High
Subscriber Privilege Escalation in WCFM Membership versions up to 2.11.11. A user with subscriber role can gain higher privileges.
- CVE-2026-3688High
The WCFM Membership plugin for WordPress is vulnerable to Insecure Direct Object Reference (IDOR) in versions up to and including 2.11.10. The 'wcfmvm_membership_change' AJAX action fails to validate user permissions to modify other users, allowing authenticated attackers with vendor-level access or higher to change any user's role to 'wcfm_vendor' by altering their membership plan.
- CVE-2026-42753High
CVE-2026-42753 describes a missing authorization vulnerability in the WC Lovers WCFM Membership plugin, allowing exploitation of incorrectly configured access control security levels. This issue affects WCFM Membership from n/a through version 2.11.10.