Live › vulnerability › CVE-2026-39777
The WCFM Membership plugin for WordPress has a missing authorization check that allows access control to be bypassed through incorrectly configured access levels. The sources do not say what data or actions an attacker gains beyond that.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-11-03 17:21 UTC. All times on this page are UTC.
The sources say the plugin is affected from its earliest version through 2.12.0, which covers sites running the WCFM Membership add-on for WooCommerce multivendor marketplaces. Sites that do not run this plugin can skip it. Whether a default configuration is exposed is unknown.
No product ranges from the sources yet.
wc-multivendor-membership plugin is installed and its version in the WordPress plugins list2.12.0Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
Missing Authorization vulnerability in WC Lovers WCFM Membership wc-multivendor-membership allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WCFM Membership: from n/a through 2.12.0.
This page as .md · .json · in your agent: get_signal("CVE-2026-39777")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.