WordPress Plugin Vulnerabilities

WCFM Membership < 2.12.1 - Subscriber+ Payment Verification Bypass

Description

The plugin does not verify that payment was made before completing a paid membership, allowing any authenticated Subscriber/Customer to activate a paid vendor membership for free and gain the marketplace vendor role.

Proof of Concept

Affects Plugins

Plugin icon
wc-multivendor-membership
Fixed in 2.12.1

References

CVE
CVE-2026-12967

Classification

Type
PRIVESC
OWASP top 10
A2: Broken Authentication and Session Management
CWE
CWE-269
CVSS
7.1 (high)

Miscellaneous

Original Researcher
Muni Nitish Kumar Yaddala
Submitter
Muni Nitish Kumar Yaddala
Verified
Yes
WPVDB ID
37e7aff5-19fd-480c-87f5-e1863a99d8b6

Timeline

Publicly Published
2026-11-03 (about 3 days ago)
Added
2026-11-03 (about 2 days ago)
Last Updated
2026-11-03 (about 2 days ago)

Other

Published
Title
Published
2018-10-11
Title
WooCommerce <= 3.4.5 - Authenticated File Deletion to Privilege Escalation
Published
2019-09-07
Title
Search Exclude < 1.2.4 - Arbitrary Settings Change
Published
2025-07-31
Title
DELUCKS SEO < 2.6.1 - Authenticated (Subscriber+) Privilege Escalation
Published
2020-05-28
Title
bbPress < 2.6.5 - Unauthenticated Privilege Escalation when New User Registration enabled
Published
2026-06-05
Title
LatePoint < 5.5.2 - Contributor+ Privilege Escalation