wcfm_membership vulnerabilities

CVEs whose affected-version data names the wcfm_membership package. Each record lists the affected and patched versions; check a specific version with the dependency checker or POST /api/sbom.

1 CVERSS

CVE-2026-12967Medium· 6.5

yesterday

WCFM Membership < 2.12.1 - Subscriber+ Payment Verification Bypass

The WCFM Membership WordPress plugin before 2.12.1 does not verify that payment was made before completing a paid membership, allowing any authenticated Subscriber/Customer to activate a paid vendor membership for free and gain the mark…

▾ SunlitEPSS 0.17%via CVEORG