CVE-2026-84756
HighCVSS 7.1Exploitation Probability (EPSS)
Low risk12th percentile - higher than 12% of all known CVEs
Summary
Subscriber Privilege Escalation in WCFM Membership versions up to 2.11.11. A user with subscriber role can gain higher privileges.
Risk Assessment
Potential for admin account takeover or unauthorized access to administrative functions.
Recommendation
Update WCFM Membership to the latest version that includes the fix.
Other vulnerabilities in WCFM Membership
See all- CVE-2026-39777Medium
Missing Authorization vulnerability in WC Lovers WCFM Membership (wc-multivendor-membership) allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects WCFM Membership from n/a through 2.12.0.
- CVE-2026-39743Medium
Missing Authorization vulnerability in WC Lovers WCFM Membership (wc-multivendor-membership) allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects WCFM Membership from n/a through 2.12.0.
- CVE-2026-3688High
The WCFM Membership plugin for WordPress is vulnerable to Insecure Direct Object Reference (IDOR) in versions up to and including 2.11.10. The 'wcfmvm_membership_change' AJAX action fails to validate user permissions to modify other users, allowing authenticated attackers with vendor-level access or higher to change any user's role to 'wcfm_vendor' by altering their membership plan.
- CVE-2026-32480Medium
Missing Authorization vulnerability in WCFM Membership by WC Lovers allows exploiting incorrectly configured access control security levels. Affects versions through 2.11.11.
- CVE-2026-42753High
CVE-2026-42753 describes a missing authorization vulnerability in the WC Lovers WCFM Membership plugin, allowing exploitation of incorrectly configured access control security levels. This issue affects WCFM Membership from n/a through version 2.11.10.
Original NVD description (English source)
Subscriber Privilege Escalation in WCFM Membership <= 2.11.11 versions.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS