Unrated severityNVD Advisory· Published Nov 6, 2026
CVE-2026-12967
CVE-2026-12967
Description
The WCFM Membership WordPress plugin before 2.12.1 does not verify that payment was made before completing a paid membership, allowing any authenticated Subscriber/Customer to activate a paid vendor membership for free and gain the marketplace vendor role.
Affected products
1- Range: <2.12.1
Patches
Vulnerability mechanics
References
1News mentions
0No linked articles in our index yet.