CVE-2026-61990 · Package
NO FIX YET
The WCFM Membership plugin for WordPress, by WC Lovers, has a missing authorization check that allows access control to be exploited when it is incorrectly configured. The sources list affected versions from n/a through 2.12.0 and do not describe what an attacker can read or change.
first public Nov 7, 2026 · 1 source
Check it with your coding agent
It checks your repository and tells you if you’re affected, with the fix.
Sites running the WCFM Membership plugin (wc-multivendor-membership) for WooCommerce multivendor marketplaces, at version 2.12.0 or earlier. The sources say the issue is tied to incorrectly configured access control levels, so sites with default settings may be less exposed; the sources do not confirm this.
Not affected if access-control-correctly-configured, plugin-not-installed
Who cares wcfm-membership, woocommerce, wordpress
2.12.0.No fix yet, per the sources.
Missing Authorization vulnerability in WC Lovers WCFM Membership wc-multivendor-membership allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WCFM Membership: from n/a through 2.12.0.
This page as .md · .json · CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.
Are you affected?
Tell InfraStack what you run. It checks this one, and every next one, against your stack.
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.