Unauthorized Data Modification Vulnerability in Klubraum Membership Request Plugin for WordPress

CVE-2026-4604

What is CVE-2026-4604?

The Klubraum Membership Request plugin for WordPress is susceptible to unauthorized data modification due to a lack of capability checks in the kr_mr_store_settings() function. This flaw allows unauthenticated attackers to alter critical plugin settings, such as the Klubraum API token and introductory text, potentially compromising the plugin's integration with the Klubraum service. Users of all plugin versions up to and including 1.1.0 should take caution and consider updating to mitigate the risks associated with this vulnerability.

References