CVE-2026-32480: WordPress WCFM Membership plugin <= 2.11.11 - Broken Access Control vulnerability
Missing Authorization vulnerability in WC Lovers WCFM Membership allows Exploiting Incorrectly Configured Access Control Security Levels.
This issue affects WCFM Membership: from n/a through 2.11.11.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
WordPress WCFM Membership pluginto a version that resolves this vulnerability.Fixed in 2.12.0
Event History
Frequently Asked Questions
Which installations are affected?
The issue affects WCFM Membership versions through 2.11.11. The provided information does not identify a fixed version.
Does exploitation require an authenticated WordPress account or user interaction?
No. The supplied CVSS vector indicates no privileges are required and no user interaction is required; the attack vector is network-based.
What is the likely security impact?
The provided severity data indicates low integrity impact, with no stated confidentiality or availability impact. The issue is described as broken access control caused by missing authorization.