WCFM CVE debriefs

These pages are published after PatchSiren validates generated defensive summaries against stored public CVE and source evidence.

MEDIUM WCFM CVE published 2026-11-06

CVE-2026-12967

The WCFM Membership WordPress plugin before 2.12.1 does not verify that payment was made before completing a paid membership, allowing any authenticated Subscriber/Customer to activate a paid vendor membership for free and gain the marketplace vendor role. This vulnerability affects WordPress installations with the WCFM Membership plugin, potentially leading to unauthorized access and privilege escalation [truncated]