WordPress plugin

Memberpress security & vulnerabilities

Q: Is any Memberpress vulnerability listed in CISA KEV?

No. None of the known Memberpress vulnerabilities is currently listed in the CISA KEV catalog.

memberpress— active installsLast vulnerability Oct 27, 2026

No known unpatched vulnerabilities in the latest version

All 8 known vulnerabilities are fixed in the latest release. If you run an older version, update to null or newer.

Watch plugin

8Known vulnerabilities

Critical0
High2
Medium6
Low0

Vulnerabilities per year

All Memberpress vulnerabilities

Memberpress vulnerabilities
Severity	Vulnerability	CVE	Published
High8.8	Cross-Site Request Forgery via 'user_email' Parameter ≤1.14.1Update to 1.14.2	CVE-2026-92797	Oct 27
High8.5	Authenticated (Contributor+) Blind Server-Side Request Forgery via mepr-user-file Shortcode ≤1.11.29Update to 1.11.30	CVE-2024-5031	May 21, 2024

High8.8
Cross-Site Request Forgery via 'user_email' Parameter
≤1.14.1Update to 1.14.2
CVE-2026-92797Oct 27
High8.5
Authenticated (Contributor+) Blind Server-Side Request Forgery via mepr-user-file Shortcode
≤1.11.29Update to 1.11.30
CVE-2024-5031May 21, 2024

Memberpress: common questions

Does Memberpress have known vulnerabilities?

Yes. VulnCrest Radar lists 8 known vulnerabilities in Memberpress: 2 high, 6 medium. None are known to affect version null.

How do I check which version of Memberpress I run?

In wp-admin open Plugins → Installed Plugins; the version is shown under the name. Without admin access, our passive Check my site tool can often read it from public files.

What is the most recent Memberpress vulnerability?

CVE-2026-92797, published Oct 27, 2026: Memberpress <= 1.14.1 - Cross-Site Request Forgery via 'user_email' Parameter. Severity: High (CVSS 8.8).

Is any Memberpress vulnerability listed in CISA KEV?

No. None of the known Memberpress vulnerabilities is currently listed in the CISA KEV catalog.