Missing authorization checks in the WCFM Membership plugin for WordPress allow an attacker with access to the plugin's endpoints to read or modify data that should be restricted. The flaw is a classic example of CWE‑862, broken access control, and can lead to the compromise of membership information or the manipulation of vendor memberships, effectively enabling unauthorized privilege escalation.

WC Lovers is affected by this vulnerability through its WCFM Membership plugin for WordPress. All releases up to and including version 2.11.10 are vulnerable; no later versions are listed as affected.

The CVSS score of 7.3 indicates a high severity. No EPSS score is available, so the exploitation likelihood remains uncertain, but the absence of a KEV listing suggests no widely known exploits yet. The likely attack vector is a web application attack where an attacker sends crafted HTTP requests to the plugin’s administrative endpoints without proper authorization checks. If a site hosts the plugin and a user can reach those endpoints, the risk of data exposure or unauthorized changes is significant, warranting immediate remediation.