Extension WordPress
Vulnérabilités WCFM Membership – WooCommerce Memberships for Multivendor Marketplace
Cette page rassemble les failles publiées pour WCFM Membership – WooCommerce Memberships for Multivendor Marketplace, leurs plages de versions affectées et les correctifs signalés dans la base locale.
Historique de sécurité
CVE et vulnérabilités de WCFM Membership – WooCommerce Memberships for Multivendor Marketplace
7 fiches
WCFM – WooCommerce Multivendor Membership <= 2.11.10 – Insecure Direct Object Reference to Limited Privilege Escalation via User Role Overwrite
The WCFM Membership – WooCommerce Memberships for Multivendor Marketplace plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 2.11.10. This is due to the 'wcfmvm_membership_change' AJAX action not validating user…
*-2.11.10
2.11.11
08/07/2026
WCFM Membership – WooCommerce Memberships for Multivendor Marketplace <= 2.11.10 – Missing Authorization
The WCFM Membership – WooCommerce Memberships for Multivendor Marketplace plugin for WordPress is vulnerable to unauthorized access due to a missing capability check on a function in versions up to, and including, 2.11.10. This makes it possible for…
*-2.11.10
2.11.11
29/05/2026
WCFM Membership – WooCommerce Memberships for Multivendor Marketplace <= 2.11.8 – Insecure Direct Object Reference to Update Membership Payment
The WCFM Membership – WooCommerce Memberships for Multivendor Marketplace plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 2.11.8 via the 'WCFMvm_Memberships_Payment_Controller::processing' due to missing validation on a user controlled…
*-2.11.8
2.11.9
09/02/2026
WCFM Membership – WooCommerce Memberships for Multivendor Marketplace <= 2.10.7 – Unauthenticated Insecure Direct Object Reference to Arbitrary User Password Change
The WCFM Membership – WooCommerce Memberships for Multivendor Marketplace plugin for WordPress is vulnerable to Insecure Direct Object References in versions up to, and including, 2.10.7. This is due to the plugin providing user-controlled access to objects, letting…
*-2.10.7
2.11.0
03/05/2023
WCFM Membership <= 2.10.0 – Missing Authorization
The WCFM Membership plugin for WordPress is vulnerable to unauthorized modification and access of data in versions up to, and including, 2.10.0 due to missing capability checks on various AJAX actions. This makes it possible for unauthenticated attackers…
*-2.10.0
2.10.1
05/04/2023
WCFM Membership <= 2.9.10 – Cross-Site Request Forgery
The WCFM Membership plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 2.9.10 due to missing nonce checks on various AJAX actions. This makes it possible for unauthenticated attackers to perform a…
*-2.9.10
2.10.0
05/04/2023
WCFM Membership <= 2.10.0 – Unauthenticated Privilege Escalation
THe WCFM Membership plugin for WordPress is vulnerable to privilege escalation in versions up to, and including 2.10.0, due to a missing capability check on the wp_ajax_nopriv_wcfm_ajax_controller AJAX action that controls membership settings. This makes it possible for…
*-2.10.0
2.10.1
05/04/2023
Extensions également surveillés
WP Commander
Rechercher dans toute la base WordPress
Utilisez la recherche globale pour retrouver une extension, un thème, une CVE ou un identifiant de vulnérabilité.