Quick answers
- Is CVE-2026-42753 exploited in the wild?
- No. Junglewise Threat Intelligence has no report of CVE-2026-42753 being exploited in the wild.
- How severe is CVE-2026-42753?
- High severity, with a CVSS score of 7.3, published 27 May 2026.
- Which products and versions are affected?
- WC Lovers WCFM Membership <= 2.11.10.
- Is there a fix for CVE-2026-42753?
- No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
- How is CVE-2026-42753 attacked?
- It is attacked over the network, in a software library.
- Am I affected by CVE-2026-42753?
- Check whether you run WC Lovers WCFM Membership at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.
Technical details
The WCFM Membership plugin for WordPress is vulnerable to missing authorization (CWE-862) in versions up to and including 2.11.10. The flaw stems from incorrectly configured access control security levels, which fail to properly validate user permissions for certain actions or data. A remote, unauthenticated attacker can exploit this over the network to bypass security restrictions. This could lead to unauthorized access to sensitive membership information or the ability to perform restricted administrative tasks. Users are advised to update to a version higher than 2.11.10 if available.
Affected products
- WC Lovers WCFM Membership (wc-multivendor-membership) <= 2.11.10
Timeline
- 2026-05-27: disclosed: Initial publication of the CVE record.
- 2026-05-27: advisory: Advisory published by Patchstack.