The flaw is an IDOR in the WCFM Membership plugin that allows a user to alter any other customer’s payment record by supplying a tampered identifier to the payment controller. This violates data integrity, potentially enabling unauthorized changes to membership billing, fraud, or service disruption. It is a moderate risk flaw with a CVSS score of 4.3 because it only compromises account integrity and requires an authenticated user.

WordPress sites running the WCFM Membership – WooCommerce Memberships for Multivendor Marketplace plugin version 2.11.8 or older are affected. The plugin is developed and maintained by WCLovers.

The vulnerability can only be exploited by an authenticated user with at least a Subscriber role, meaning the attacker must have or compromise a legitimate account. No remote code execution or privileged escalation is involved. The EPSS score of less than 1% indicates a very low probability of exploitation, and the flaw is not listed in the CISA KEV catalog. The attack path is simple: send a crafted request to the payment processing endpoint without proper ownership validation. The CVSS score reflects the moderate impact and limited attacker capability.