CVE-2026-12967mediumCWE-269

CVE-2026-12967: medium-severity vulnerability in WCFM Membership

WCFM Membership < 2.12.1 - Subscriber+ Payment Verification Bypass

Published

Follow this CVE+ Monitor WCFM Membership

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

33Vexday Risk Score

No sign of exploitation. It has a public proof of concept.

ssvc Attendcvss 6.5epss 0.2%
The WCFM Membership WordPress plugin before 2.12.1 does not verify that payment was made before completing a paid membership, allowing any authenticated Subscriber/Customer to activate a paid vendor membership for free and gain the marketplace vendor role.
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N
Affected products
Unknown · WCFM Membership
⚠ Public resources, to assess the exposure of systems you control or are authorized to test. Test only with authorization.