CSRF Vulnerability in Memberful Membership Plugin by WordPress
CVE-2026-103067

8HIGH

Key Information:

Vendor

WordPress
Status
Memberful - Membership Plugin
Vendor
CVE Published:
1 October 2026

What is CVE-2026-103067?

The Memberful Membership Plugin for WordPress has a Cross-Site Request Forgery (CSRF) vulnerability that can be exploited by attackers to make unauthorized requests on behalf of users. This can result in unintended actions being performed, leading to potential data leakage or unauthorized access. Users of versions up to 1.81.0 should ensure their installations are updated to safeguard against such exploits.

Affected Version(s)

Memberful - Membership Plugin 0 <= 1.81.0

References

https://patchstack.com/database/wordpress/plugin/memberfu...
vdb-entry

CVSS V3.1

Score:
8
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
Required
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

henise | Patchstack Bug Bounty Program
.