CVE-2025-15147

Name of the Vulnerable Software and Affected Versions WCFM Membership – WooCommerce Memberships for Multivendor Marketplace plugin for WordPress versions up to and including 2.11.8

Description The WCFM Membership – WooCommerce Memberships for Multivendor Marketplace plugin for WordPress is susceptible to an Insecure Direct Object Reference issue in all versions up to and including 2.11.8. This is due to a lack of validation on a user-controlled key within the WCFMvm Memberships Payment Controller::processing function. Authenticated attackers with Subscriber-level access or higher can potentially modify membership payments belonging to other users.

Recommendations Update the WCFM Membership – WooCommerce Memberships for Multivendor Marketplace plugin to a version later than 2.11.8.