Description
The WCFM Membership WordPress plugin before 2.12.1 does not verify that payment was made before completing a paid membership, allowing any authenticated Subscriber/Customer to activate a paid vendor membership for free and gain the marketplace vendor role.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| — | WCFM Membership | < 2.12.1 | 2.12.1 |
References
- https://wpscan.com/vulnerability/37e7aff5-19fd-480c-87f5-e1863a99d8b6/ exploit vdb-entry technical-description