Payment Verification Flaw in WCFM Membership Plugin by WordPress
CVE-2026-12967

Currently unrated

Key Information:

Vendor

WordPress
Status
Wcfm Membership
Vendor
CVE Published:
6 November 2026

Badges

👾 Exploit Exists🟡 Public PoC

What is CVE-2026-12967?

A security issue in the WCFM Membership WordPress plugin before version 2.12.1 allows authenticated users with Subscriber or Customer roles to bypass payment verification. This flaw enables these users to activate a paid vendor membership without completing the payment process, effectively granting them unauthorized access to the marketplace vendor role. Proper verification mechanisms are essential to prevent such unauthorized access and protect the integrity of the membership system.

Affected Version(s)

WCFM Membership 0 < 2.12.1

Exploit Proof of Concept (PoC)

PoC code is written by security researchers to demonstrate the vulnerability can be exploited. PoC code is also a key component for weaponization which could lead to ransomware.

CVE-2026-12967 - Proof of Concept

References

https://wpscan.com/vulnerability/37e7aff5-19fd-480c-87f5-...
exploitvdb-entrytechnical-description

Timeline

  • 🟡

    Public PoC available

  • 👾

    Exploit known to exist

  • Vulnerability published

  • Vulnerability Reserved

Credit

Muni Nitish Kumar Yaddala
WPScan
.