CVE-2026-61990: WordPress WCFM Membership plugin <= 2.12.0 - Broken Access Control vulnerability

Q: Which installations are affected?

The issue affects WCFM Membership installations through version 2.12.0. The available data does not identify an unaffected fixed version.

Q: What access or conditions does an attacker need to exploit this issue?

The available information identifies missing authorization and incorrectly configured access-control levels, but does not specify the required attacker privileges, request path, or configuration conditions.

Q: How can I determine whether an installation has already been exploited?

The provided data does not include indicators of compromise, affected functions, or logging details that would support confirming exploitation.

Published Nov 7, 2026

Updated

Missing Authorization vulnerability in WC Lovers WCFM Membership wc-multivendor-membership allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WCFM Membership: from n/a through 2.12.0.

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade WC Lovers WCFM Membership to a version that resolves this vulnerability.
Fixed in 2.12.1

Event History

Nov 7, 2026

CVE Published

via MITRE·09:11 AM

Data Sourced

via MITRE·09:11 AM

RemedyDescriptionSeverityWeakness

Frequently Asked Questions

Which installations are affected?

The issue affects WCFM Membership installations through version 2.12.0. The available data does not identify an unaffected fixed version.

What access or conditions does an attacker need to exploit this issue?

The available information identifies missing authorization and incorrectly configured access-control levels, but does not specify the required attacker privileges, request path, or configuration conditions.

How can I determine whether an installation has already been exploited?

The provided data does not include indicators of compromise, affected functions, or logging details that would support confirming exploitation.

CVE-2026-61990: WordPress WCFM Membership plugin <= 2.12.0 - Broken Access Control vulnerability

Remediation

Event History

Frequently Asked Questions

Which installations are affected?

What access or conditions does an attacker need to exploit this issue?

How can I determine whether an installation has already been exploited?

Company

Resources

Contact

Frequently Asked Questions

Which installations are affected?

What access or conditions does an attacker need to exploit this issue?

How can I determine whether an installation has already been exploited?