Home

Description

The WCFM Membership – WooCommerce Memberships for Multivendor Marketplace plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 2.11.10. This is due to the 'wcfmvm_membership_change' AJAX action not validating user permission to modify other users. This makes it possible for authenticated attackers, with vendor level access and above, to change any user's role to 'wcfm_vendor' by changing their membership plan.

PUBLISHED Reserved 2026-03-06 | Published 2026-07-08 | Updated 2026-07-08 | Assigner Wordfence




HIGH: 8.1CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H

Problem types

CWE-639 Authorization Bypass Through User-Controlled Key

Product status

Default status
unaffected

Any version
affected

Timeline

2026-01-10:Discovered
2026-03-07:Vendor Notified
2026-07-07:Disclosed

Credits

Osvaldo Noe Gonzalez Del Rio (Os) finder

References

www.wordfence.com/...-9330-4585-9994-838940d24980?source=cve

plugins.trac.wordpress.org/...0777/wc-multivendor-membership

cve.org (CVE-2026-3688)

nvd.nist.gov (CVE-2026-3688)

Download JSON