CVE-2022-4939: Wclovers Wcfm Membership

Critical severity, CVSS 9.8. EPSS: 2.1% chance of exploitation in the next 30 days.

THe WCFM Membership plugin for WordPress is vulnerable to privilege escalation in versions up to, and including 2.10.0, due to a missing capability check on the wp_ajax_nopriv_wcfm_ajax_controller AJAX action that controls membership settings. This makes it possible for unauthenticated attackers to modify the membership registration form in a way that allows them to set the role for registration to that of any user including administrators. Once configured, the attacker can then register as an administrator.

Affected products

• Wclovers Wcfm Membership: before 2.10.1 (fixed in 2.10.1)

Published 2023-04-05. Last modified 2026-06-17.