CVE-2022-4940highobserved exploitationCWE-862

CVE-2022-4940: high-severity vulnerability in wclovers WCFM Membership – WooCommerce…

WCFM Membership <= 2.10.0 - Missing Authorization

Published · Updated

Follow this CVE+ Monitor WCFM Membership – WooCommerce Memberships for Multivendor Marketplace

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

58Vexday Risk Score

Patch now. It exploitation observed by VulnCheck and has a working public exploit.

ssvc Actcvss 7.3epss 1.1%
from disclosure to weapon
Published on NVDApr 5
VulnCheck+1d
The WCFM Membership plugin for WordPress is vulnerable to unauthorized modification and access of data in versions up to, and including, 2.10.0 due to missing capability checks on various AJAX actions. This makes it possible for unauthenticated attackers to perform a wide variety of actions such as modifying membership details, changing renewal information, controlling membership approvals, and more.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L
Affected products
wclovers · WCFM Membership – WooCommerce Memberships for Multivendor Marketplace
Related CVEs — wclovers WCFM Membership – WooCommerce…

In the same product, most dangerous first.

CVE-2022-4939CRITICALWCFM Membership <= 2.10.0 - Unauthenticated Privilege EscalationEPSS 2.1%CVE-2023-2276CRITICALWCFM Membership – WooCommerce Memberships for Multivendor Marketplace <= 2.10.7 - Unauthenticated Insecure Direct Object Reference to Arbitrary User Password ChangeEPSS 1.1%CVE-2026-3688HIGHWCFM - WooCommerce Multivendor Membership <= 2.11.10 - Insecure Direct Object Reference to Limited Privilege Escalation via User Role OverwriteEPSS 0.4%CVE-2022-4941MEDIUMWCFM Membership <= 2.9.10 - Cross-Site Request ForgeryEPSS 0.3%CVE-2025-15147MEDIUMWCFM Membership – WooCommerce Memberships for Multivendor Marketplace <= 2.11.8 - Insecure Direct Object Reference to Update Membership PaymentEPSS 0.3%