A Cross‑Site Request Forgery vulnerability exists in the Memberful – Membership Plugin when its version is 1.81.0 or older. The plugin fails to validate state‑changing requests properly, allowing an attacker to craft a request that runs in the security context of an authenticated user and modifies membership data or settings without consent. This flaw, identified as CWE‑352, can compromise the integrity of membership management, potentially granting elevated privileges or disabling user access.

WordPress sites that rely on the Memberful – Membership Plugin, particularly those using any version up to and including 1.81.0. The vulnerability is present across all releases from the earliest available version through 1.81.0, regardless of site size or configuration.

Because the plugin lacks CSRF tokens or same‑origin checks, an attacker can target logged‑in users by sending a malicious link or form that submits to the plugin’s actions. No additional authentication is required beyond the user’s existing session, making exploitation straightforward if the attacker can entice the user to visit the crafted URL. The CVSS score of 8 signals high severity, though the EPSS score is unavailable and it is not listed in the CISA KEV catalogue. The risk is significant for sites that grant sensitive privileges via the plugin.