WordPress plugin
WCFM Membership – WooCommerce Memberships for Multivendor Marketplace security & vulnerabilities
No known unpatched vulnerabilities in the latest version
All 14 known vulnerabilities are fixed in the latest release. If you run an older version, update to null or newer.
- Critical2
- High3
- Medium9
- Low0
All WCFM Membership – WooCommerce Memberships for Multivendor Marketplace vulnerabilities
| Severity | Vulnerability | CVE | Published |
|---|---|---|---|
| Medium4.3 | Missing Authorization ≤2.12.0Update to 2.12.1 | CVE-2026-61990 | |
| High7.2 | Unauthenticated Stored Cross-Site Scripting ≤2.12.0Update to 2.12.1 | CVE-2026-39744 | |
| Medium6.3 | Authenticated (Subscriber+) Privilege Escalation ≤2.12.0Update to 2.12.1 | CVE-2026-12967 | |
| Medium5.3 | Missing Authorization ≤2.12.0Update to 2.12.1 | CVE-2026-39743 | |
| Medium4.3 | Missing Authorization ≤2.12.0Update to 2.12.1 | CVE-2026-39777 | |
| Medium5.3 | Missing Authorization ≤2.11.11Update to 2.12.0 | CVE-2026-32480 | |
| Medium6.3 | Authenticated (Subscriber+) Privilege Escalation ≤2.11.11Update to 2.12.0 | CVE-2026-84756 | |
| High8.1 | WooCommerce Multivendor Membership <= 2.11.10 - Insecure Direct Object Reference to Limited Privilege Escalation via User Role Overwrite ≤2.11.10Update to 2.11.11 | CVE-2026-3688 | |
| Medium5.3 | Missing Authorization ≤2.11.10Update to 2.11.11 | CVE-2026-42753 | |
| Medium4.3 | Insecure Direct Object Reference to Update Membership Payment ≤2.11.8Update to 2.11.9 | CVE-2025-15147 | |
| Critical9.8 | Unauthenticated Insecure Direct Object Reference to Arbitrary User Password Change ≤2.10.7Update to 2.11.0 | CVE-2023-2276 | |
| Medium6.3 | Cross-Site Request Forgery ≤2.9.10Update to 2.10.0 | CVE-2022-4941 | |
| High7.3 | Missing Authorization ≤2.10.0Update to 2.10.1 | CVE-2022-4940 | |
| Critical9.8 | Unauthenticated Privilege Escalation ≤2.10.0Update to 2.10.1 | CVE-2022-4939 |
- Medium4.3Missing Authorization
≤2.12.0Update to 2.12.1
- High7.2Unauthenticated Stored Cross-Site Scripting
≤2.12.0Update to 2.12.1
- Medium6.3Authenticated (Subscriber+) Privilege Escalation
≤2.12.0Update to 2.12.1
- Medium5.3Missing Authorization
≤2.12.0Update to 2.12.1
- Medium4.3Missing Authorization
≤2.12.0Update to 2.12.1
- Medium5.3Missing Authorization
≤2.11.11Update to 2.12.0
- Medium6.3Authenticated (Subscriber+) Privilege Escalation
≤2.11.11Update to 2.12.0
- High8.1WooCommerce Multivendor Membership <= 2.11.10 - Insecure Direct Object Reference to Limited Privilege Escalation via User Role Overwrite
≤2.11.10Update to 2.11.11
- Medium5.3Missing Authorization
≤2.11.10Update to 2.11.11
- Medium4.3Insecure Direct Object Reference to Update Membership Payment
≤2.11.8Update to 2.11.9
- Critical9.8Unauthenticated Insecure Direct Object Reference to Arbitrary User Password Change
≤2.10.7Update to 2.11.0
- Medium6.3Cross-Site Request Forgery
≤2.9.10Update to 2.10.0
- High7.3Missing Authorization
≤2.10.0Update to 2.10.1
- Critical9.8Unauthenticated Privilege Escalation
≤2.10.0Update to 2.10.1
WCFM Membership – WooCommerce Memberships for Multivendor Marketplace: common questions
Does WCFM Membership – WooCommerce Memberships for Multivendor Marketplace have known vulnerabilities?
Yes. VulnCrest Radar lists 14 known vulnerabilities in WCFM Membership – WooCommerce Memberships for Multivendor Marketplace: 2 critical, 3 high, 9 medium. None are known to affect version null.
How do I check which version of WCFM Membership – WooCommerce Memberships for Multivendor Marketplace I run?
In wp-admin open Plugins → Installed Plugins; the version is shown under the name. Without admin access, our passive Check my site tool can often read it from public files.
What is the most recent WCFM Membership – WooCommerce Memberships for Multivendor Marketplace vulnerability?
CVE-2026-61990, published Nov 7, 2026: WCFM Membership – WooCommerce Memberships for Multivendor Marketplace <= 2.12.0 - Missing Authorization. Severity: Medium (CVSS 4.3).
Is any WCFM Membership – WooCommerce Memberships for Multivendor Marketplace vulnerability listed in CISA KEV?
No. None of the known WCFM Membership – WooCommerce Memberships for Multivendor Marketplace vulnerabilities is currently listed in the CISA KEV catalog.