CVE-2026-12967: WCFM Membership < 2.12.1 - Subscriber+ Payment Verification Bypass

Q: Who can exploit this issue?

Any authenticated user with the Subscriber or Customer role can exploit it. The issue can result in the user gaining the marketplace vendor role without paying for a paid membership.

Q: Are sites using free memberships affected?

The described bypass applies when completing a paid membership. The provided information does not indicate an impact on free membership workflows.

Q: What versions are affected?

WCFM Membership versions before 2.12.1 are affected. Updating to version 2.12.1 or later addresses the affected version range.

Published Nov 6, 2026

Updated

The WCFM Membership WordPress plugin before 2.12.1 does not verify that payment was made before completing a paid membership, allowing any authenticated Subscriber/Customer to activate a paid vendor membership for free and gain the marketplace vendor role.

Event History

Nov 6, 2026

CVE Published

via MITRE·06:00 AM

Data Sourced

via MITRE·06:00 AM

DescriptionWeakness

Frequently Asked Questions

Who can exploit this issue?

Any authenticated user with the Subscriber or Customer role can exploit it. The issue can result in the user gaining the marketplace vendor role without paying for a paid membership.

Are sites using free memberships affected?

The described bypass applies when completing a paid membership. The provided information does not indicate an impact on free membership workflows.

What versions are affected?

WCFM Membership versions before 2.12.1 are affected. Updating to version 2.12.1 or later addresses the affected version range.

CVE-2026-12967: WCFM Membership < 2.12.1 - Subscriber+ Payment Verification Bypass

Event History

Frequently Asked Questions

Who can exploit this issue?

Are sites using free memberships affected?

What versions are affected?

Company

Resources

Contact

Frequently Asked Questions

Who can exploit this issue?

Are sites using free memberships affected?

What versions are affected?