CVE-2026-3688

Name of the Vulnerable Software and Affected Versions WCFM Membership – WooCommerce Memberships for Multivendor Marketplace versions prior to 2.11.11

Description The plugin contains an Insecure Direct Object Reference (IDOR), a flaw where an application provides direct access to objects based on user-supplied input. This occurs because the wcfmvm membership change AJAX action fails to validate whether the user has the necessary permissions to modify other users. Consequently, authenticated attackers with vendor-level access or higher can change any user's role to wcfm vendor by altering their membership plan.

Recommendations Update the plugin to a version newer than 2.11.10. As a temporary mitigation, restrict access to the wcfmvm membership change AJAX action for users with vendor-level privileges.