WCFM Membership <= 2.10.0 - Broken Access Control

The WCFM Membership plugin for WordPress is vulnerable to unauthorized modification and access of data in versions up to, and including, 2.10.0 due to missing capability checks true the AJAX actions: wcfm-memberships, wcfm-memberships-manage, and wcfm-memberships-settings. id: CVE-2022-4940 info:...

WCFM WooCommerce Multivendor Marketplace < 3.4.12 - SQL Injection

The wcfmajaxcontroller AJAX action of the WCFM Marketplace WordPress plugin before 3.4.12, available to unauthenticated and authenticated user, does not properly sanitise multiple parameters before using them in SQL statements, leading to SQL injections. id: CVE-2021-24849 info: name: WCFM...

PoC-CVE-2022-4939-

PoC-CVE-2022-4939 The attacker sends a specially crafted request to the wpajaxnoprivwcfmajaxcontroller AJAX action to modify the membership registration form and set the registration role to that of an administrator. Then, the plugin processes the request and modifies the membership registration...

WordPress WCFM Marketplace – Multivendor Marketplace for WooCommerce plugin <= 3.8.2 - Unauthenticated SQL Injection vulnerability

Unauthenticated SQL Injection vulnerability discovered by Jonah Burgess CryptoCat in WordPress Plugin WCFM Marketplace versions = 3.8.2...

CVE-2026-18442

The WCFM Marketplace – Multivendor Marketplace for WooCommerce plugin for WordPress is vulnerable to generic SQL Injection via the 'wcfmmpuserlocationlng' parameter in all versions up to, and including, 3.8.2 due to insufficient escaping on the user supplied parameter and lack of sufficient...

EUVD-2026-82748

The WCFM Marketplace – Multivendor Marketplace for WooCommerce plugin for WordPress is vulnerable to generic SQL Injection via the 'wcfmmpuserlocationlng' parameter in all versions up to, and including, 3.8.2 due to insufficient escaping on the user supplied parameter and lack of sufficient...

CVE-2026-18442

WCFM Marketplace – Multivendor Marketplace for WooCommerce (WordPress plugin) is vulnerable to unauthenticated SQL injection via the 'wcfmmp_user_location_lng' and 'wcfmmp_user_location_lat' parameters in all versions up to, and including, 3.8.2 . The root cause is insufficient escaping on user-s...

CVE-2026-18442 WCFM Marketplace <= 3.8.2 - Unauthenticated SQL Injection via 'wcfmmp_user_location_lat' / 'wcfmmp_user_location_lng' Parameter

The WCFM Marketplace – Multivendor Marketplace for WooCommerce plugin for WordPress is vulnerable to generic SQL Injection via the 'wcfmmpuserlocationlng' parameter in all versions up to, and including, 3.8.2 due to insufficient escaping on the user supplied parameter and lack of sufficient...

CVE-2026-32480

Missing Authorization vulnerability in WC Lovers WCFM Membership allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects WCFM Membership: from n/a through 2.11.11...

EUVD-2026-70969

Missing Authorization vulnerability in WC Lovers WCFM Membership allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects WCFM Membership: from n/a through 2.11.11...

CVE-2026-32480 WordPress WCFM Membership plugin <= 2.11.11 - Broken Access Control vulnerability

Missing Authorization vulnerability in WC Lovers WCFM Membership allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects WCFM Membership: from n/a through 2.11.11...

CVE-2026-32480

CVE-2026-32480 affects the WCFM Membership WordPress plugin (by WC Lovers) in versions up to and including 2.11.11 . The vulnerability is a missing authorization (broken access control) flaw that allows exploitation of incorrectly configured access control security levels. The CVSS v3.1 score is ...

WordPress WCFM Membership plugin <= 2.11.11 - Broken Access Control vulnerability

Broken Access Control vulnerability discovered by mySebbe in WordPress Plugin WCFM Membership versions = 2.11.11...

CVE-2026-84756

Subscriber Privilege Escalation in WCFM Membership = 2.11.11 versions...

CVE-2026-84756 WordPress WCFM Membership plugin <= 2.11.11 - Privilege Escalation vulnerability

Subscriber Privilege Escalation in WCFM Membership = 2.11.11 versions...

EUVD-2026-70586

Subscriber Privilege Escalation in WCFM Membership = 2.11.11 versions...

CVE-2026-84756

CVE-2026-84756 is a privilege escalation vulnerability affecting the WCFM Membership WordPress plugin in versions 2.11.11 and below . The flaw allows a user with Subscriber privileges to escalate their access level. The vulnerability is rated HIGH (CVSS 3.1: 7.1) , with a network attack vector, l...

CVE-2026-83562

Contributor Cross Site Scripting XSS in WCFM Marketplace = 3.8.2 versions...

CVE-2026-81286

Unauthenticated SQL Injection in WCFM Marketplace = 3.8.1 versions...

WordPress WCFM Membership plugin <= 2.11.11 - Privilege Escalation vulnerability

Privilege Escalation vulnerability discovered by yagamimoon in WordPress Plugin WCFM Membership versions = 2.11.11...