CVE-2026-3688: WCFM Membership Auth Bypass Vulnerability

CVE-2026-3688 Overview

CVE-2026-3688 affects the WCFM Membership – WooCommerce Memberships for Multivendor Marketplace plugin for WordPress. The vulnerability exists in all versions up to and including 2.11.10. The wcfmvm_membership_change AJAX action fails to validate whether the requesting user has permission to modify other users. Authenticated attackers with vendor-level access or above can change any user's role to wcfm_vendor by manipulating their membership plan. This is an Insecure Direct Object Reference flaw tracked as [CWE-639].

Critical Impact
Authenticated vendor-level users can modify arbitrary user accounts, reassign roles, and compromise marketplace integrity through unauthorized membership plan changes.

Affected Products

WCFM Membership – WooCommerce Memberships for Multivendor Marketplace plugin for WordPress
All versions up to and including 2.11.10
WordPress sites running the wc-multivendor-membership plugin

Discovery Timeline

2026-07-08 - CVE-2026-3688 published to NVD
2026-07-08 - Last updated in NVD database

Technical Details for CVE-2026-3688

Vulnerability Analysis

The vulnerability resides in the wcfmvm_membership_change AJAX endpoint exposed by the WCFM Membership plugin. The endpoint accepts a user identifier and membership plan parameter but does not verify that the authenticated caller owns the target account. This missing authorization check allows an attacker to reference any user object in the database and modify it. The plugin then invokes the standard role assignment logic and applies the wcfm_vendor role to the specified user. Attackers can therefore hijack administrator or customer accounts by converting them into vendor accounts under attacker-controlled membership plans.

Root Cause

The root cause is a missing authorization check in the AJAX handler for wcfmvm_membership_change. The function trusts the user_id value supplied in the request body without confirming it matches the current session or that the caller holds sufficient capabilities to modify other users. This pattern maps directly to [CWE-639] Authorization Bypass Through User-Controlled Key.

Attack Vector

Exploitation requires an authenticated session with vendor-level permissions or higher on the target WordPress site. The attacker submits an AJAX POST request to the vulnerable endpoint containing a target user identifier and a membership plan identifier. The plugin processes the request as if it were legitimate self-service activity and updates the target user's role. No user interaction from the victim is required, and the attack is executed entirely over the network.

Because no verified proof-of-concept code is published, refer to the Wordfence Vulnerability Report and the WordPress plugin changeset for technical details on the fix.

Detection Methods for CVE-2026-3688

Indicators of Compromise

Unexpected user role changes to wcfm_vendor in the WordPress wp_usermeta table
POST requests to admin-ajax.php with the action=wcfmvm_membership_change parameter targeting user_id values other than the caller's own
New vendor accounts appearing without corresponding registration audit records
Membership plan modifications originating from vendor accounts targeting administrator or customer users

Detection Strategies

Monitor WordPress audit logs for role transitions involving the wcfm_vendor capability set
Alert on repeated calls to the wcfmvm_membership_change AJAX action from a single authenticated session
Correlate membership plan changes with the identity of the requesting user and flag mismatches

Monitoring Recommendations

Enable verbose logging on admin-ajax.php requests and retain logs for at least 90 days
Review vendor account activity daily for privilege changes affecting other users
Baseline normal membership plan change volumes and alert on statistical anomalies

How to Mitigate CVE-2026-3688

Immediate Actions Required

Update the WCFM Membership plugin to a version later than 2.11.10 that contains the fix from changeset 3520777
Audit all WordPress accounts for unauthorized wcfm_vendor role assignments
Rotate credentials for any administrator accounts that were converted to vendor accounts
Restrict vendor registration to reduce the pool of authenticated attackers

Patch Information

The vendor released a fix in the wc-multivendor-membership plugin. Review the WordPress plugin changeset 3520777 for the code changes. Additional analysis is available in the Wordfence Vulnerability Report.

Workarounds

Disable the WCFM Membership plugin until the patched version is deployed
Use a web application firewall rule to block action=wcfmvm_membership_change requests where the user_id parameter does not match the authenticated session
Temporarily reduce vendor account privileges and require administrator approval for membership plan changes

bash

# Example WAF rule concept for admin-ajax.php
# Block wcfmvm_membership_change requests where user_id differs from session user
SecRule REQUEST_URI "@contains admin-ajax.php" \
  "chain,deny,status:403,id:2026003688,msg:'Block WCFM IDOR CVE-2026-3688'"
  SecRule ARGS:action "@streq wcfmvm_membership_change" \
    "chain"
    SecRule ARGS:user_id "!@streq %{SESSION.user_id}"