CVE-2026-4604 Overview
CVE-2026-4604 is a missing authorization vulnerability in the Klubraum Membership Request plugin for WordPress. The flaw affects all versions up to and including 1.1.0. The kr_mr_store_settings() function does not perform a capability check before persisting plugin settings. Unauthenticated attackers can send crafted requests to modify the plugin configuration, including the Klubraum API token and the introduction text shown to visitors. The issue is tracked under [CWE-862] Missing Authorization.
Critical Impact
Unauthenticated attackers can hijack the plugin's integration with the Klubraum service by overwriting API credentials and settings, redirecting membership requests or tampering with content shown to site visitors.
Affected Products
- Klubraum Membership Request plugin for WordPress, versions up to and including 1.1.0
- WordPress sites integrating with the Klubraum service through this plugin
- Any deployment exposing the plugin's settings handler over the network
Discovery Timeline
- 2026-07-29 - CVE-2026-4604 published to the National Vulnerability Database (NVD)
- 2026-07-30 - Last updated in NVD database
Technical Details for CVE-2026-4604
Vulnerability Analysis
The Klubraum Membership Request plugin exposes a settings handler backed by the kr_mr_store_settings() function. This handler writes plugin options such as the Klubraum API token and the introduction text used in the widget. The function processes incoming requests without validating that the caller holds an administrative capability such as manage_options. Attackers reach the endpoint over the network with no authentication and no user interaction. Overwriting the API token points the plugin's integration at an attacker-controlled Klubraum tenant. Modifying the introduction text allows tampering with content that legitimate site visitors see. The vulnerability affects integrity of stored settings; confidentiality and availability of the WordPress site are not directly impacted by this specific weakness.
Root Cause
The root cause is a missing capability check inside kr_mr_store_settings() in admin/class-klubraum-membership-request-widget-admin.php. The function should call current_user_can() with an administrator-level capability before persisting values. Without this gate, any request that reaches the settings handler is treated as authorized. The public WordPress Plugin Code Review and the corresponding WordPress Changeset Review show the vulnerable code path.
Attack Vector
An attacker crafts an HTTP POST request to the plugin's settings handler on a target WordPress site. The request supplies attacker-controlled values for the Klubraum API token and introduction text. Because the handler skips authorization, WordPress writes the values into the options table. Follow-up membership requests generated by the plugin then flow through the attacker's Klubraum tenant, and the widget renders attacker-supplied introduction content. See the Wordfence Vulnerability Analysis for additional technical detail.
Detection Methods for CVE-2026-4604
Indicators of Compromise
- Unexpected changes to WordPress options associated with the Klubraum Membership Request plugin, particularly the API token and introduction text fields
- POST requests from unauthenticated sources targeting the plugin's admin-side settings handler in class-klubraum-membership-request-widget-admin.php
- Membership submissions routed to a Klubraum tenant that does not match the site owner's account
Detection Strategies
- Review web server access logs for POST requests referencing the Klubraum plugin's settings endpoint from clients without a valid authenticated administrator session cookie
- Compare current values of Klubraum plugin options against a known-good baseline stored outside the database
- Enable WordPress audit logging to record option changes and identify writes that occur without a logged-in administrator context
Monitoring Recommendations
- Alert on modifications to the Klubraum plugin's option rows in wp_options outside of scheduled maintenance windows
- Monitor outbound traffic from the WordPress host to Klubraum API hostnames and flag connections using unexpected token values
- Track WordPress plugin version inventory and generate alerts when the Klubraum Membership Request plugin remains at 1.1.0 or earlier
How to Mitigate CVE-2026-4604
Immediate Actions Required
- Update the Klubraum Membership Request plugin to a version later than 1.1.0 that includes the capability check fix referenced in the plugin changeset
- Rotate the Klubraum API token after patching, since the previous token may have been overwritten or observed
- Audit the plugin's stored settings and restore the correct API token and introduction text if tampering is suspected
Patch Information
The WordPress.org plugin repository changeset introduces an authorization check in the settings handler. Site administrators should install the fixed release published after version 1.1.0. Details of the code change are available in the WordPress Changeset Review and the Wordfence Vulnerability Analysis.
Workarounds
- Deactivate the Klubraum Membership Request plugin until a patched version is installed
- Restrict access to /wp-admin/ paths from untrusted networks using a web application firewall or reverse proxy allow list
- Add a WAF rule that blocks unauthenticated POST requests targeting the plugin's settings handler in class-klubraum-membership-request-widget-admin.php
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
