Live › vulnerability › CVE-2026-92797
Go to dashboardMemberPress up to and including 1.14.1 skips its nonce check when the nonce parameter is omitted, so save_profile_fields() accepts forged requests. An attacker who tricks a logged-in user into clicking a link can change that user's email and then reset the password to take over the account.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-28 08:31 UTC. All times on this page are UTC.
Any WordPress site running MemberPress or earlier is affected, because the flaw is in the plugin's profile-saving code path. Sites without MemberPress installed are not affected. The sources do not say whether a non-default setting is required.
1.14.1No product ranges from the sources yet.
wp plugin get memberpress --field=version1.14.1; the sources do not name the patched versionEach row is the first time that source carried this signal. The analyst’s rows are its own findings.
The MemberPress plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 1.14.1. This is due to a bypassable nonce verification check in the save_profile_fields() function that uses an isset() condition at line 1119, allowing the security check to be completely bypassed by simply omitting the nonce parameter from the request. This makes it possible for unauthenticated attackers to change authenticated users' email addresses via a forged request granted they can trick an authenticated user into performing an action such as clicking on a link, leading to account takeover through password reset functionality.
This page as .md · .json · in your agent: get_signal("CVE-2026-92797")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.