Description

The WCFM Membership WordPress plugin before 2.12.1 does not verify that payment was made before completing a paid membership, allowing any authenticated Subscriber/Customer to activate a paid vendor membership for free and gain the marketplace vendor role.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "6.5",
  "pubDate": "2026-11-06T06:16:42.560Z",
  "pubdate": "2026-11-06T06:16:42.560Z",
  "executiveSummary": "The WCFM Membership WordPress plugin prior to version 2.12.1 is susceptible to an improper authorization vulnerability that facilitates unauthorized privilege escalation.\nThe flaw allows authenticated users with low-level permissions, such as Subscribers or Customers, to bypass payment verification workflows intended for premium membership upgrades.\nBy manipulating the membership activation process, an attacker can illicitly acquire the marketplace vendor role without completing a financial transaction.\nThis vulnerability presents a significant risk to marketplace integrity, as it grants unauthorized users administrative capabilities and access to restricted vendor-level features and data within the application environment.\nExploitation requires the attacker to hold an existing account on the WordPress site; no specialized network access or external tools are typically required beyond standard application interaction to trigger the logic flaw.\nThis vulnerability highlights a critical failure in server-side validation, specifically the lack of mandatory transaction state verification before state transition completion.",
  "technicalDetails": "The vulnerability resides in the membership processing logic within the WCFM Membership plugin, where the system fails to enforce rigorous server-side validation of payment status prior to upgrading a user's role.\nThe root cause is an insecure implementation of the membership activation workflow, which improperly trusts the client-side state or fails to perform a verification callback to the payment gateway before updating the WordPress 'wp_usermeta' or role assignment tables.\nThe attack flow commences when an authenticated user initiates the subscription process for a paid membership tier. Instead of relying on a legitimate IPN (Instant Payment Notification) or a successful return signal from a payment processor (such as Stripe or PayPal), the application logic processes the role upgrade prematurely.\nBecause the server-side component does not validate the transaction token or the success status of the payment, an attacker can submit a request that triggers the function responsible for granting the 'wcfm_vendor' capability.\nAn attacker can exploit this by intercepting the membership enrollment request and ensuring the parameters identifying the plan are present, effectively forcing the application to execute the role elevation function.\nSince the application does not cross-reference the user's payment history or pending transaction status during this function call, the user's role is updated to 'vendor' in the WordPress database.\nPost-exploitation, the attacker gains full access to the WCFM vendor dashboard, which includes the ability to manage products, view marketplace sales data, and access private vendor communication channels, depending on the site's specific configuration.\nThis bypasses the intended business logic, resulting in a complete failure of the access control mechanism for paid premium features.\nThe affected versions include all releases of WCFM Membership prior to 2.12.1. The vulnerability is exploitable by any authenticated user, regardless of their original assigned role, provided the registration or membership upgrade functionality is accessible to them."
}