Live Vulnerability Intelligence
Threat Database
Search CVEs, inspect descriptions, and open detail pages with AI-assisted technical context.
Threat Entry
Updated 2026-09-04
Wc Multivendor Membership - Broken Access Control (CVE-2026-32480)
Missing Authorization vulnerability in WC Lovers WCFM Membership allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects WCFM Membership: from n/a through 2.11.11.
PLUGIN
Wc Multivendor Membership
CVE-2026-32480
Risk Score
Threat Entry
Updated 2026-09-07
Wc Multivendor Membership - Privilege Escalation (CVE-2026-84756)
Subscriber Privilege Escalation in WCFM Membership
PLUGIN
Wc Multivendor Membership
CVE-2026-84756
Risk Score
Threat Entry
Updated 2026-07-08
Wc Multivendor Membership - Security Vulnerability (CVE-2026-3688)
The WCFM Membership – WooCommerce Memberships for Multivendor Marketplace plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 2.11.10. This is due to the 'wcfmvm_membership_change' AJAX action not validating user permission to modify other users. This makes it possible for authenticated attackers, with vendor level access and above, to change any user's role to 'wcfm_vendor' by changing their membership plan.
PLUGIN
Wc Multivendor Membership
CVE-2026-3688
Risk Score
Threat Entry
Updated 2026-06-17
Wc Multivendor Membership - Broken Access Control (CVE-2026-42753)
Missing Authorization vulnerability in WC Lovers WCFM Membership wc-multivendor-membership allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WCFM Membership: from n/a through
PLUGIN
Wc Multivendor Membership
CVE-2026-42753
Risk Score
Threat Entry
Updated 2026-06-17
Wc Multivendor Membership - Security Vulnerability (CVE-2025-15147)
The WCFM Membership – WooCommerce Memberships for Multivendor Marketplace plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 2.11.8 via the 'WCFMvm_Memberships_Payment_Controller::processing' due to missing validation on a user controlled key. This makes it possible for authenticated attackers, with Subscriber-level access and above, to modify other users' membership payments.
PLUGIN
Wc Multivendor Membership
CVE-2025-15147
Risk Score
Threat Entry
Updated 2026-06-17
Wc Multivendor Membership - Security Vulnerability (CVE-2023-2276)
The WCFM Membership – WooCommerce Memberships for Multivendor Marketplace plugin for WordPress is vulnerable to Insecure Direct Object References in versions up to, and including, 2.10.7. This is due to the plugin providing user-controlled access to objects, letting a user bypass authorization and access system resources. This makes it possible for unauthenticated attackers to change user passwords and potentially take over administrator accounts.
PLUGIN
Wc Multivendor Membership
CVE-2023-2276
Risk Score