CVE-2026-4604

Name of the Vulnerable Software and Affected Versions Klubraum Membership Request versions prior to 1.1.1

Description The Klubraum Membership Request plugin for WordPress allows unauthorized modification of data because the kr mr store settings() function lacks a capability check. This flaw enables unauthenticated attackers to update plugin settings, such as the introduction text and the Klubraum API token, which can lead to the hijacking of the integration with the Klubraum service.

Recommendations Update the plugin to a version later than 1.1.0. As a temporary mitigation, restrict access to the kr mr store settings() function.