{"id":"CVE-2026-61990","kind":"vulnerability","aliases":["CVE-2026-61990"],"related":[],"title":"WCFM Membership WordPress plugin: missing authorization check through 2.12.0","description":"Missing Authorization vulnerability in WC Lovers WCFM Membership wc-multivendor-membership allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WCFM Membership: from n/a through 2.12.0.","summary":"The WCFM Membership plugin for WordPress, by WC Lovers, has a missing authorization check that allows access control to be exploited when it is incorrectly configured. The sources list affected versions from n/a through 2.12.0 and do not describe what an attacker can read or change.","severity":"medium","cvss":4.3,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["package","wcfm-membership","woocommerce","wordpress"],"not_affected_if":["access-control-correctly-configured","plugin-not-installed"],"how_to_check":"- Check the installed version of the wc-multivendor-membership plugin in the WordPress admin under Plugins.\n- Compare it with the affected range: through `2.12.0`.","fix":null,"status":"open","published_at":"2026-11-07T10:17:12+00:00","first_seen_at":"2026-11-07T10:46:41+00:00","triaged_at":"2026-11-07T10:48:50+00:00","updated_at":"2026-11-07T10:48:50+00:00","category":"package","confidence":0.4,"triage":{"at":"2026-11-07T10:48:50Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"internet","title":"WCFM Membership WordPress plugin: missing authorization check through 2.12.0","impact":"medium","summary":"The WCFM Membership plugin for WordPress, by WC Lovers, has a missing authorization check that allows access control to be exploited when it is incorrectly configured. The sources list affected versions from n/a through 2.12.0 and do not describe what an attacker can read or change.","audience":"businesses","category":"package","nicknames":[],"who_cares":["wordpress","woocommerce","wcfm-membership"],"confidence":0.4,"fix_status":"unknown","needs_auth":"unknown","worst_case":"unknown access to membership-restricted functions on the store","analyst_note":"Find the advisory or changelog for the fixed version and the exact unauthorized action, using the NVD entry at https://nvd.nist.gov/vuln/detail/CVE-2026-61990.","how_to_check":"- Check the installed version of the wc-multivendor-membership plugin in the WordPress admin under Plugins.\n- Compare it with the affected range: through `2.12.0`.","plain_action":"","needs_analyst":true,"not_affected_if":["plugin-not-installed","access-control-correctly-configured"],"who_is_affected":"Sites running the WCFM Membership plugin (wc-multivendor-membership) for WooCommerce multivendor marketplaces, at version 2.12.0 or earlier. The sources say the issue is tied to incorrectly configured access control levels, so sites with default settings may be less exposed; the sources do not confirm this.","user_interaction":"unknown","needs_special_setup":"yes","severity_if_unknown":"medium"},"cost_usd":0.000716,"input_tokens":4219,"output_tokens":588,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-2026':11A,14A '-61990':12A,15A '2.12.0':9A,56B,95C 'access':38B,84C 'affect':51B,89C 'allow':37B,80C 'attack':63B 'author':6A,34B,69C 'chang':67B 'check':7A,35B 'configur':47B,83C 'control':39B,85C 'cve':10A,13A 'describ':60B 'exploit':42B,81C 'incorrect':46B,82C 'issu':88C 'levels.this':87C 'list':50B 'lover':30B,73C 'membership':2A,19B,24B,75C,79C,91C 'miss':5A,33B,68C 'multivendor':78C 'n/a':54B,93C 'packag':16B 'plugin':4A,25B 'read':65B 'secur':86C 'sourc':49B 'version':52B 'vulner':70C 'wc':29B,72C,77C 'wc-multivendor-membership':76C 'wcfm':1A,18B,23B,74C,90C 'wcfm-membership':17B 'woocommerc':20B 'wordpress':3A,21B,27B","nicknames":[],"mitigations":[],"who_affected":"Sites running the WCFM Membership plugin (wc-multivendor-membership) for WooCommerce multivendor marketplaces, at version 2.12.0 or earlier. The sources say the issue is tied to incorrectly configured access control levels, so sites with default settings may be less exposed; the sources do not confirm this.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"none","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["medium","package","wcfmmembership","woocommerce","wordpress"],"campaign_type":null,"search_a":"'-2026':11A,14A '-61990':12A,15A '2.12.0':9A 'author':6A 'check':7A 'cve':10A,13A 'membership':2A 'miss':5A 'plugin':4A 'wcfm':1A 'wordpress':3A","search_b":"'2.12.0':56B 'access':38B 'affect':51B 'allow':37B 'attack':63B 'author':34B 'chang':67B 'check':35B 'configur':47B 'control':39B 'describ':60B 'exploit':42B 'incorrect':46B 'list':50B 'lover':30B 'membership':19B,24B 'miss':33B 'n/a':54B 'packag':16B 'plugin':25B 'read':65B 'sourc':49B 'version':52B 'wc':29B 'wcfm':18B,23B 'wcfm-membership':17B 'woocommerc':20B 'wordpress':21B,27B","search_c":"'2.12.0':95C 'access':84C 'affect':89C 'allow':80C 'author':69C 'configur':83C 'control':85C 'exploit':81C 'incorrect':82C 'issu':88C 'levels.this':87C 'lover':73C 'membership':75C,79C,91C 'miss':68C 'multivendor':78C 'n/a':93C 'secur':86C 'vulner':70C 'wc':72C,77C 'wc-multivendor-membership':76C 'wcfm':74C,90C","first_public_at":"2026-11-07T10:17:12+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N","cvss_by":"audit@patchstack.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-61990","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-61990","severity":null,"published_at":"2026-11-07T10:17:12+00:00","modified_at":"2026-11-07T10:17:12+00:00","first_seen_at":"2026-11-07T10:46:41+00:00","fetched_at":"2026-11-07T10:46:41+00:00","note":null}],"documents":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}