{"id":"CVE-2026-92797","kind":"vulnerability","aliases":["CVE-2026-92797"],"related":[],"title":"MemberPress WordPress plugin: CSRF lets attackers change user emails, take over accounts","description":"The MemberPress plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 1.14.1. This is due to a bypassable nonce verification check in the save_profile_fields() function that uses an isset() condition at line 1119, allowing the security check to be completely bypassed by simply omitting the nonce parameter from the request. This makes it possible for unauthenticated attackers to change authenticated users' email addresses via a forged request granted they can trick an authenticated user into performing an action such as clicking on a link, leading to account takeover through password reset functionality.","summary":"MemberPress up to and including 1.14.1 skips its nonce check when the nonce parameter is omitted, so save_profile_fields() accepts forged requests. An attacker who tricks a logged-in user into clicking a link can change that user's email and then reset the password to take over the account.","severity":"high","cvss":8.8,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["memberpress","package","wordpress"],"not_affected_if":["memberpress-not-installed"],"how_to_check":"- Check the installed MemberPress plugin version in the WordPress admin Plugins screen or with `wp plugin get memberpress --field=version`\n- unknown","fix":"- Update MemberPress to a version later than `1.14.1`; the sources do not name the patched version\n- unknown","status":"open","published_at":"2026-10-28T08:16:30+00:00","first_seen_at":"2026-10-28T08:31:53+00:00","triaged_at":"2026-10-28T08:33:47+00:00","updated_at":"2026-10-28T08:33:47+00:00","category":"package","confidence":0.7,"triage":{"at":"2026-10-28T08:33:47Z","model":"claude-haiku-5-5","output":{"fix":"- Update MemberPress to a version later than `1.14.1`; the sources do not name the patched version\n- unknown","reach":"internet","title":"MemberPress WordPress plugin: CSRF lets attackers change user emails, take over accounts","impact":"high","summary":"MemberPress up to and including 1.14.1 skips its nonce check when the nonce parameter is omitted, so save_profile_fields() accepts forged requests. An attacker who tricks a logged-in user into clicking a link can change that user's email and then reset the password to take over the account.","category":"package","nicknames":[],"who_cares":["wordpress","memberpress"],"confidence":0.7,"needs_auth":"no","worst_case":"Attacker takes over logged-in user accounts via email change and password reset","analyst_note":"Find the patched MemberPress version and the vendor advisory in the NVD entry references, since the sources list no fixed version.","how_to_check":"- Check the installed MemberPress plugin version in the WordPress admin Plugins screen or with `wp plugin get memberpress --field=version`\n- unknown","needs_analyst":true,"not_affected_if":["memberpress-not-installed"],"who_is_affected":"Any WordPress site running MemberPress `1.14.1` or earlier is affected, because the flaw is in the plugin's profile-saving code path. Sites without MemberPress installed are not affected. The sources do not say whether a non-default setting is required.","user_interaction":"yes","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.000608,"input_tokens":3417,"output_tokens":532,"severity_before":"high"},"analyst_status":null,"analyst_note":null,"search":"'-2026':14A,17A '-92797':15A,18A '1.14.1':27B,93C '1119':116C 'accept':42B 'account':12A,73B,170C 'action':161C 'address':146C 'allow':117C 'attack':6A,46B,140C 'authent':143C,156C 'bypass':99C,124C 'chang':7A,59B,142C 'check':31B,102C,120C 'click':55B,164C 'complet':123C 'condit':113C 'cross':83C 'cross-sit':82C 'csrf':4A 'cve':13A,16A 'due':96C 'email':9A,63B,145C 'field':41B,107C 'forg':43B,149C 'forgeri':86C 'function':108C,175C 'grant':151C 'includ':26B,92C 'isset':112C 'lead':168C 'let':5A 'line':115C 'link':57B,167C 'log':51B 'logged-in':50B 'make':135C 'memberpress':1A,19B,22B,75C 'nonc':30B,34B,100C,129C 'omit':37B,127C 'packag':20B 'paramet':35B,130C 'password':68B,173C 'perform':159C 'plugin':3A,76C 'possibl':137C 'profil':40B,106C 'request':44B,85C,133C,150C 'reset':66B,174C 'save':39B,105C 'secur':119C 'simpli':126C 'site':84C 'skip':28B 'take':10A,70B 'takeov':171C 'trick':48B,154C 'unauthent':139C 'use':110C 'user':8A,53B,61B,144C,157C 'verif':101C 'version':88C 'via':147C 'vulner':80C 'wordpress':2A,21B,78C","nicknames":[],"mitigations":[],"who_affected":"Any WordPress site running MemberPress `1.14.1` or earlier is affected, because the flaw is in the plugin's profile-saving code path. Sites without MemberPress installed are not affected. The sources do not say whether a non-default setting is required.","tier":"B","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-28T08:16:30+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","cvss_by":"security@wordfence.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-92797","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-92797","severity":null,"published_at":"2026-10-28T08:16:30+00:00","modified_at":"2026-10-28T08:16:30+00:00","first_seen_at":"2026-10-28T08:31:53+00:00","fetched_at":"2026-10-28T08:31:53+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}