CVE-2026-61994: WordPress WP-Members plugin <= 3.5.7 - Broken Access Control vulnerability
Published Oct 12, 2026
·Updated
Missing Authorization vulnerability in RocketGeek WP-Members wp-members allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WP-Members: from n/a through 3.5.7.
Affected Software
1 affected component
RocketGeek WP-Members<=3.5.7
Event History
Oct 12, 2026
CVE Published
via MITRE·05:51 PM
Data Sourced
via MITRE·05:51 PM
DescriptionSeverityWeakness
Data Sourced
via NVD·06:17 PM
DescriptionSeverityWeakness
Frequently Asked Questions
1
What level of access does an attacker need to exploit this issue?
The attacker needs low-level privileges and network access. No user interaction is required.
2
Which installations are affected?
RocketGeek WP-Members versions through 3.5.7 are affected. The affected version range begins at an unspecified earlier version.
3
What is the expected security impact?
The issue is rated medium severity with low confidentiality and integrity impact. No availability impact is indicated.