# CVE-2026-42753: WC Lovers WCFM Membership missing authorization

Source: https://junglewise.ai/threats/cve-2026-42753-wc-lovers-wcfm-membership-missing-authorization  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-05-27. Updated: 2026-05-27  
License: CC BY 4.0 with a link back

CVE-2026-42753 · Severity: high · CVSS 7.3 · Published 2026-05-27

A security flaw has been identified in the WCFM Membership plugin, which is used to manage vendor subscriptions and memberships on WordPress-based e-commerce sites. This vulnerability allows unauthorized individuals to bypass intended access restrictions due to incorrectly configured security levels. An attacker could potentially access or modify data they should not have permission to see, impacting the integrity and privacy of the membership system.

Technologies: [WC Lovers WCFM Membership](https://junglewise.ai/threats/technologies/wcfm-membership). Vendors: [WC Lovers](https://junglewise.ai/threats/vendors/wc-lovers).

## Quick answers

**Is CVE-2026-42753 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-42753 being exploited in the wild.

**How severe is CVE-2026-42753?** High severity, with a CVSS score of 7.3, published 27 May 2026.

**Which products and versions are affected?** WC Lovers WCFM Membership <= 2.11.10.

**Is there a fix for CVE-2026-42753?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2026-42753 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2026-42753?** Check whether you run WC Lovers WCFM Membership at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

The WCFM Membership plugin for WordPress is vulnerable to missing authorization (CWE-862) in versions up to and including 2.11.10. The flaw stems from incorrectly configured access control security levels, which fail to properly validate user permissions for certain actions or data. A remote, unauthenticated attacker can exploit this over the network to bypass security restrictions. This could lead to unauthorized access to sensitive membership information or the ability to perform restricted administrative tasks. Users are advised to update to a version higher than 2.11.10 if available.

## Affected products

- WC Lovers WCFM Membership (wc-multivendor-membership) <= 2.11.10

## Timeline

- 2026-05-27: disclosed: Initial publication of the CVE record.
- 2026-05-27: advisory: Advisory published by Patchstack.

## References

- [https://patchstack.com/database/Wordpress/Plugin/wc-multivendor-membership/vulnerability/wordpress-wcfm-membership-plugin-2-11-10-broken-access-control-vulnerability?_s_id=cve](https://patchstack.com/database/Wordpress/Plugin/wc-multivendor-membership/vulnerability/wordpress-wcfm-membership-plugin-2-11-10-broken-access-control-vulnerability?_s_id=cve)

## Related threats

- [WC Lovers WCFM Membership broken access control](https://junglewise.ai/threats/cve-2026-61990-missing-authorization-vulnerability-in-wc-lovers-wcfm-membership)
- [WC Lovers WCFM Membership stored cross-site scripting](https://junglewise.ai/threats/cve-2026-39744-improper-neutralization-of-input-during-web-page-generation-cross)
- [WC Lovers WCFM Membership broken access control](https://junglewise.ai/threats/cve-2026-39777-missing-authorization-vulnerability-in-wc-lovers-wcfm-membership)
- [WC Lovers WCFM Membership broken access control](https://junglewise.ai/threats/cve-2026-39743-missing-authorization-vulnerability-in-wc-lovers-wcfm-membership)
- [WC Lovers WCFM Membership broken access control vulnerability](https://junglewise.ai/threats/cve-2026-32480-wc-lovers-wcfm-membership-broken-access-control-vulnerability)