# CVE-2026-84756: WCFM Membership privilege escalation

Source: https://junglewise.ai/threats/cve-2026-84756-wcfm-membership-privilege-escalation  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-09-03. Updated: 2026-09-25  
License: CC BY 4.0 with a link back

CVE-2026-84756 · Severity: high · CVSS 7.1 · Published 2026-09-03

WCFM Membership is a WordPress plugin that manages vendor memberships and access for WooCommerce multivendor marketplaces. A low-privilege subscriber user can escalate their account to administrator, gaining full control over the WordPress site, including access to sensitive business data, customer information, and the ability to modify site content or inject malware.

Technologies: [WC Lovers WCFM Membership](https://junglewise.ai/threats/technologies/wcfm-membership). Vendors: [WC Lovers](https://junglewise.ai/threats/vendors/wc-lovers).

## Quick answers

**Is CVE-2026-84756 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-84756 being exploited in the wild.

**How severe is CVE-2026-84756?** High severity, with a CVSS score of 7.1, published 3 September 2026.

**Which products and versions are affected?** WC Lovers WCFM Membership <=2.11.11.

**Is there a fix for CVE-2026-84756?** A patch was published on 2026-09-02: Fixed in version 2.12.0 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-84756 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2026-84756?** Check whether you run WC Lovers WCFM Membership at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

This vulnerability is a privilege escalation flaw in WCFM Membership plugin versions up to 2.11.11. A subscriber-level user can exploit an authentication or authorization bypass to elevate their privileges to administrator without proper access controls. The vulnerability requires only subscriber-level access to trigger and can be exploited remotely by an authenticated attacker. Full details of the vulnerable component or attack mechanism are not disclosed in the advisory. The issue has been patched in version 2.12.0.

## Affected products

- WC Lovers WCFM Membership <=2.11.11

## Timeline

- 2026-09-03: disclosed
- 2026-09-02: patched: Fixed in version 2.12.0
- 2026-06-21: other: Reported by yagamimoon

## References

- [https://wordpress.org/plugins](https://wordpress.org/plugins)
- [https://patchstack.com/database/wordpress/plugin/wc-multivendor-membership/vulnerability/wordpress-wcfm-membership-plugin-2-11-11-privilege-escalation-vulnerability?_s_id=cve](https://patchstack.com/database/wordpress/plugin/wc-multivendor-membership/vulnerability/wordpress-wcfm-membership-plugin-2-11-11-privilege-escalation-vulnerability?_s_id=cve)

## Related threats

- [WC Lovers WCFM Membership broken access control](https://junglewise.ai/threats/cve-2026-61990-missing-authorization-vulnerability-in-wc-lovers-wcfm-membership)
- [WC Lovers WCFM Membership stored cross-site scripting](https://junglewise.ai/threats/cve-2026-39744-improper-neutralization-of-input-during-web-page-generation-cross)
- [WC Lovers WCFM Membership broken access control](https://junglewise.ai/threats/cve-2026-39777-missing-authorization-vulnerability-in-wc-lovers-wcfm-membership)
- [WC Lovers WCFM Membership broken access control](https://junglewise.ai/threats/cve-2026-39743-missing-authorization-vulnerability-in-wc-lovers-wcfm-membership)
- [WC Lovers WCFM Membership broken access control vulnerability](https://junglewise.ai/threats/cve-2026-32480-wc-lovers-wcfm-membership-broken-access-control-vulnerability)