{"id":"CVE-2026-12967","kind":"vulnerability","aliases":["CVE-2026-12967"],"related":[],"title":"WCFM Membership WordPress plugin: free paid membership grants vendor role","description":"The WCFM Membership  WordPress plugin before 2.12.1 does not verify that payment was made before completing a paid membership, allowing any authenticated Subscriber/Customer to activate a paid vendor membership for free and gain the marketplace vendor role.","summary":"The WCFM Membership WordPress plugin before 2.12.1 does not check that payment was made before completing a paid membership. Any logged-in Subscriber or Customer can activate a paid vendor membership for free and gain the marketplace vendor role.","severity":"high","cvss":null,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["marketplace","package","wcfm","woocommerce","wordpress"],"not_affected_if":["no-paid-memberships","plugin-version-2.12.1-or-later"],"how_to_check":"- Check the installed version of the WCFM Membership plugin in the WordPress admin plugin list; versions before `2.12.1` are in scope.\n- Review user accounts that hold the vendor role and have no matching payment record.","fix":"- WCFM Membership: move to `2.12.1` or later.","status":"open","published_at":"2026-11-06T06:16:42+00:00","first_seen_at":"2026-11-06T06:40:12+00:00","triaged_at":"2026-11-06T06:41:44+00:00","updated_at":"2026-11-06T06:41:44+00:00","category":"package","confidence":0.7,"triage":{"at":"2026-11-06T06:41:44Z","model":"claude-haiku-5-5","output":{"fix":"- WCFM Membership: move to `2.12.1` or later.","reach":"internet","title":"WCFM Membership WordPress plugin: free paid membership grants vendor role","impact":"medium","summary":"The WCFM Membership WordPress plugin before 2.12.1 does not check that payment was made before completing a paid membership. Any logged-in Subscriber or Customer can activate a paid vendor membership for free and gain the marketplace vendor role.","audience":"businesses","category":"package","nicknames":[],"who_cares":["wordpress","wcfm","marketplace","woocommerce"],"confidence":0.7,"fix_status":"available","needs_auth":"yes","worst_case":"A shopper gains vendor role on the marketplace without paying.","analyst_note":"","how_to_check":"- Check the installed version of the WCFM Membership plugin in the WordPress admin plugin list; versions before `2.12.1` are in scope.\n- Review user accounts that hold the vendor role and have no matching payment record.","plain_action":"","needs_analyst":false,"not_affected_if":["plugin-version-2.12.1-or-later","no-paid-memberships"],"who_is_affected":"Sites running the WCFM Membership plugin before 2.12.1 that sell vendor memberships on a WordPress marketplace. Exposure needs a logged-in Subscriber or Customer account, which most stores allow by default for shoppers. Sites without WCFM Membership, or without paid vendor memberships, can skip it.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.000698,"input_tokens":4204,"output_tokens":555,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'-12967':13A,16A '-2026':12A,15A '2.12.1':28B,68C 'activ':49B,86C 'allow':81C 'authent':83C 'check':31B 'complet':37B,77C 'custom':47B 'cve':11A,14A 'free':5A,55B,92C 'gain':57B,94C 'grant':8A 'log':43B 'logged-in':42B 'made':35B,75C 'marketplac':17B,59B,96C 'membership':2A,7A,24B,40B,53B,64C,80C,90C 'packag':18B 'paid':6A,39B,51B,79C,88C 'payment':33B,73C 'plugin':4A,26B,66C 'role':10A,61B,98C 'subscrib':45B 'subscriber/customer':84C 'vendor':9A,52B,60B,89C,97C 'verifi':71C 'wcfm':1A,19B,23B,63C 'woocommerc':20B 'wordpress':3A,21B,25B,65C","nicknames":[],"mitigations":[],"who_affected":"Sites running the WCFM Membership plugin before 2.12.1 that sell vendor memberships on a WordPress marketplace. Exposure needs a logged-in Subscriber or Customer account, which most stores allow by default for shoppers. Sites without WCFM Membership, or without paid vendor memberships, can skip it.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["high","marketplace","package","wcfm","woocommerce","wordpress"],"campaign_type":null,"search_a":"'-12967':13A,16A '-2026':12A,15A 'cve':11A,14A 'free':5A 'grant':8A 'membership':2A,7A 'paid':6A 'plugin':4A 'role':10A 'vendor':9A 'wcfm':1A 'wordpress':3A","search_b":"'2.12.1':28B 'activ':49B 'check':31B 'complet':37B 'custom':47B 'free':55B 'gain':57B 'log':43B 'logged-in':42B 'made':35B 'marketplac':17B,59B 'membership':24B,40B,53B 'packag':18B 'paid':39B,51B 'payment':33B 'plugin':26B 'role':61B 'subscrib':45B 'vendor':52B,60B 'wcfm':19B,23B 'woocommerc':20B 'wordpress':21B,25B","search_c":"'2.12.1':68C 'activ':86C 'allow':81C 'authent':83C 'complet':77C 'free':92C 'gain':94C 'made':75C 'marketplac':96C 'membership':64C,80C,90C 'paid':79C,88C 'payment':73C 'plugin':66C 'role':98C 'subscriber/customer':84C 'vendor':89C,97C 'verifi':71C 'wcfm':63C 'wordpress':65C","first_public_at":"2026-11-06T06:16:42+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-12967","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-12967","severity":null,"published_at":"2026-11-06T06:16:42+00:00","modified_at":"2026-11-06T06:16:42+00:00","first_seen_at":"2026-11-06T06:40:12+00:00","fetched_at":"2026-11-06T06:40:12+00:00","note":null}],"documents":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}