---
id: "CVE-2026-92797"
kind: "vulnerability"
aliases: ["CVE-2026-92797"]
title: "MemberPress WordPress plugin: CSRF lets attackers change user emails, take over accounts"
severity: "high"
cvss: 8.8
epss: null
exploited: false
status: "open"
category: "package"
products: []
ecosystems: []
tags: ["memberpress", "package", "wordpress"]
not_affected_if: ["memberpress-not-installed"]
published_at: "2026-10-28T08:16:30+00:00"
first_seen_at: "2026-10-28T08:31:53+00:00"
updated_at: "2026-10-28T08:33:47+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-92797", "first_seen_at": "2026-10-28T08:31:53+00:00"}]
---

# MemberPress WordPress plugin: CSRF lets attackers change user emails, take over accounts

MemberPress up to and including 1.14.1 skips its nonce check when the nonce parameter is omitted, so save_profile_fields() accepts forged requests. An attacker who tricks a logged-in user into clicking a link can change that user's email and then reset the password to take over the account.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check the installed MemberPress plugin version in the WordPress admin Plugins screen or with `wp plugin get memberpress --field=version`
- unknown

## Fix

- Update MemberPress to a version later than `1.14.1`; the sources do not name the patched version
- unknown

## Timeline

- 2026-10-28T08:31:53+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-92797

## From the sources

The MemberPress plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 1.14.1. This is due to a bypassable nonce verification check in the save_profile_fields() function that uses an isset() condition at line 1119, allowing the security check to be completely bypassed by simply omitting the nonce parameter from the request. This makes it possible for unauthenticated attackers to change authenticated users' email addresses via a forged request granted they can trick an authenticated user into performing an action such as clicking on a link, leading to account takeover through password reset functionality.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_