Cross-Site Request Forgery in MemberPress Plugin for WordPress
CVE-2026-92797

8.8HIGH

Key Information:

Vendor

WordPress
Status
Memberpress
Vendor
CVE Published:
28 October 2026

What is CVE-2026-92797?

The MemberPress plugin for WordPress has a security vulnerability that permits Cross-Site Request Forgery attacks due to a bypassable nonce verification check in the save_profile_fields() function. This vulnerability allows unauthenticated attackers to modify the email addresses of authenticated users if they can trick those users into performing specific actions, such as clicking on a malicious link. By exploiting this flaw, attackers could gain access to the password reset functionality, leading to potential account takeover.

Affected Version(s)

Memberpress 0 <= 1.14.1

References

https://www.wordfence.com/threat-intel/vulnerabilities/id...
https://memberpress.com/change-log/#1.14.2

CVSS V3.1

Score:
8.8
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
Required
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Matthew Cowan
.