Live › vulnerability › CVE-2026-39743
The WCFM Membership plugin for WooCommerce multivendor stores has a missing authorization check, so access control settings can be exploited. The description says it affects versions from n/a through 2.12.0 and gives no details of what an attacker can read or change.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-11-03 17:21 UTC. All times on this page are UTC.
Sites running the WCFM Membership plugin (wc-multivendor-membership) at version 2.12.0 or earlier with WooCommerce multivendor membership features in use. Sites without this plugin installed are not affected.
No product ranges from the sources yet.
wp plugin get wc-multivendor-membership --field=version2.12.02.12.0 are reported by the source as not affected; the exact fixed version is unknownEach row is the first time that source carried this signal. The analyst’s rows are its own findings.
Missing Authorization vulnerability in WC Lovers WCFM Membership wc-multivendor-membership allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WCFM Membership: from n/a through 2.12.0.
This page as .md · .json · in your agent: get_signal("CVE-2026-39743")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.