Access Control Misconfiguration in Tips and Tricks HQ WP eMember Plugin
CVE-2026-28070

5.3MEDIUM

Key Information:

Vendor

WordPress
Status
WP Emember
Vendor
CVE Published:
19 March 2026

What is CVE-2026-28070?

A missing authorization vulnerability in the Tips and Tricks HQ WP eMember plugin allows attackers to exploit incorrectly configured access control security levels. This issue can lead to unauthorized access to sensitive data and functions within the plugin, posing significant security risks to sites utilizing affected versions. Administrators are advised to review their access settings and update to the latest version of WP eMember to mitigate this vulnerability.

Affected Version(s)

WP eMember <= n/a

References

https://patchstack.com/database/wordpress/plugin/wp-ememb...
vdb-entry

CVSS V3.1

Score:
5.3
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
None
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Tran Nguyen Bao Khanh (VCI - VNPT Cyber Immunity) | Patchstack Bug Bounty Program
.