CVE-2023-2276: Wclovers Wcfm Membership

Critical severity, CVSS 9.8. EPSS: 1.1% chance of exploitation in the next 30 days.

The WCFM Membership – WooCommerce Memberships for Multivendor Marketplace plugin for WordPress is vulnerable to Insecure Direct Object References in versions up to, and including, 2.10.7. This is due to the plugin providing user-controlled access to objects, letting a user bypass authorization and access system resources. This makes it possible for unauthenticated attackers to change user passwords and potentially take over administrator accounts.

Affected products

• Wclovers Wcfm Membership: up to and including 2.10.7

Published 2023-05-20. Last modified 2026-06-17.