WCFM Membership <= 2.10.0 - Broken Access Control

The WCFM Membership plugin for WordPress is vulnerable to unauthorized modification and access of data in versions up to, and including, 2.10.0 due to missing capability checks true the AJAX actions: wcfm-memberships, wcfm-memberships-manage, and wcfm-memberships-settings. id: CVE-2022-4940 info:...

WCFM WooCommerce Multivendor Marketplace < 3.4.12 - SQL Injection

The wcfmajaxcontroller AJAX action of the WCFM Marketplace WordPress plugin before 3.4.12, available to unauthenticated and authenticated user, does not properly sanitise multiple parameters before using them in SQL statements, leading to SQL injections. id: CVE-2021-24849 info: name: WCFM...

PoC-CVE-2022-4939-

PoC-CVE-2022-4939 攻撃者は、wpajaxnoprivwcfmajaxcontroller AJAX アクションに特別に細工されたリクエストを送信し、会員登録フォームを変更して登録ロールを管理者に設定します。その後、プラグインはリクエストを処理し、ユーザーが管理者ロールで登録できるように会員登録フォームを変更します。攻撃者は、変更された会員登録フォームを送信することで、管理者ロールを持つ新しいユーザーとして登録できます。...

CVE-2026-32480

Missing Authorization vulnerability in WC Lovers WCFM Membership allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects WCFM Membership: from n/a through 2.11.11...

CVE-2026-32480 WordPress WCFM Membership plugin <= 2.11.11 - Broken Access Control vulnerability

Missing Authorization vulnerability in WC Lovers WCFM Membership allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects WCFM Membership: from n/a through 2.11.11...

EUVD-2026-70969

Missing Authorization vulnerability in WC Lovers WCFM Membership allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects WCFM Membership: from n/a through 2.11.11...

CVE-2026-32480

CVE-2026-32480 affects the WCFM Membership WordPress plugin (by WC Lovers) in versions up to and including 2.11.11 . The vulnerability is a missing authorization (broken access control) flaw that allows exploitation of incorrectly configured access control security levels. The CVSS v3.1 score is ...

WordPress WCFM Membership plugin <= 2.11.11 - Broken Access Control vulnerability

Broken Access Control vulnerability discovered by mySebbe in WordPress Plugin WCFM Membership versions = 2.11.11...

CVE-2026-84756

Subscriber Privilege Escalation in WCFM Membership = 2.11.11 versions...

CVE-2026-84756 WordPress WCFM Membership plugin <= 2.11.11 - Privilege Escalation vulnerability

Subscriber Privilege Escalation in WCFM Membership = 2.11.11 versions...

EUVD-2026-70586

Subscriber Privilege Escalation in WCFM Membership = 2.11.11 versions...

CVE-2026-84756

CVE-2026-84756 is a privilege escalation vulnerability affecting the WCFM Membership WordPress plugin in versions 2.11.11 and below . The flaw allows a user with Subscriber privileges to escalate their access level. The vulnerability is rated HIGH (CVSS 3.1: 7.1) , with a network attack vector, l...

CVE-2026-81286

Unauthenticated SQL Injection in WCFM Marketplace = 3.8.1 versions...

WordPress WCFM Membership plugin <= 2.11.11 - Privilege Escalation vulnerability

Privilege Escalation vulnerability discovered by yagamimoon in WordPress Plugin WCFM Membership versions = 2.11.11...

CVE-2026-83562

CVE-2026-83562 is a Contributor Cross Site Scripting (XSS) vulnerability in the WordPress plugin WCFM Marketplace (versions ≤ 3.8.2 ). Discovered by Ananda Dhakal via Patchstack, the flaw requires an authenticated contributor-level user and user interaction to exploit, but results in a changed sc...

EUVD-2026-69934

Contributor Cross Site Scripting XSS in WCFM Marketplace = 3.8.2 versions...

CVE-2026-83562 WordPress WCFM Marketplace plugin <= 3.8.2 - Cross Site Scripting (XSS) vulnerability

Contributor Cross Site Scripting XSS in WCFM Marketplace = 3.8.2 versions...

CVE-2026-81286 WordPress WCFM Marketplace plugin <= 3.8.1 - SQL Injection vulnerability

Unauthenticated SQL Injection in WCFM Marketplace = 3.8.1 versions...

EUVD-2026-69923

Unauthenticated SQL Injection in WCFM Marketplace = 3.8.1 versions...

CVE-2026-81286

CVE-2026-81286 is an unauthenticated SQL Injection in the WCFM Marketplace WordPress plugin, affecting versions 3.8.1 and earlier . The CNA (Patchstack) assigns a CVSS 3.1 score of 9.3 (CRITICAL) with a changed scope, indicating high confidentiality impact and low availability impact with no requ...