CVE-2026-39777: WordPress WCFM Membership plugin <= 2.12.0 - Broken Access Control vulnerability

Q: What level of access does an attacker need to exploit this issue?

The CVSS vector indicates that an attacker needs low-level privileges (PR:L). Exploitation does not require user interaction and can be performed over the network.

Q: What is the likely impact if exploited?

The listed impact is limited to integrity (I:L), meaning an attacker may be able to make unauthorized modifications. No confidentiality or availability impact is identified in the provided CVSS vector.

Q: Which plugin versions are affected?

WCFM Membership versions through 2.12.0 are affected. The available information does not identify a fixed version.

Published Nov 3, 2026

Updated

Missing Authorization vulnerability in WC Lovers WCFM Membership wc-multivendor-membership allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WCFM Membership: from n/a through 2.12.0.

Event History

Nov 3, 2026

CVE Published

via MITRE·04:55 PM

Data Sourced

via MITRE·04:55 PM

RemedyDescriptionSeverityWeakness

Data Sourced

via NVD·05:18 PM

DescriptionSeverityWeakness

Frequently Asked Questions

What level of access does an attacker need to exploit this issue?

The CVSS vector indicates that an attacker needs low-level privileges (PR:L). Exploitation does not require user interaction and can be performed over the network.

What is the likely impact if exploited?

The listed impact is limited to integrity (I:L), meaning an attacker may be able to make unauthorized modifications. No confidentiality or availability impact is identified in the provided CVSS vector.

Which plugin versions are affected?

WCFM Membership versions through 2.12.0 are affected. The available information does not identify a fixed version.

CVE-2026-39777: WordPress WCFM Membership plugin <= 2.12.0 - Broken Access Control vulnerability

Event History

Frequently Asked Questions

What level of access does an attacker need to exploit this issue?

What is the likely impact if exploited?

Which plugin versions are affected?

Company

Resources

Contact

Frequently Asked Questions

What level of access does an attacker need to exploit this issue?

What is the likely impact if exploited?

Which plugin versions are affected?