Missing authorization in the WCFM Membership plugin allows an attacker to perform privileged actions beyond the intended user scopes. The flaw stems from incorrectly configured access control levels, enabling exploitation of non‑privileged users to access or modify data that should be restricted. The CVSS score of 4.3 indicates moderate impact, suggesting capabilities such as unauthorized content or user level changes, but not arbitrary code execution.

WC Lovers WCFM Membership plugin for WordPress. Versions 2.12.0 and earlier are vulnerable.

CVE-2026-61990 has a CVSS score of 4.3, which reflects moderate severity. The EPSS score is not available, so current probability of exploitation is uncertain, and the vulnerability is not listed in the CISA KEV catalog. The likely attack vector is through web requests interacting with the plugin’s endpoints, exploiting the improperly set access control. An attacker with sufficient permissions to interact with the plugin can bypass the intended restrictions and perform unauthorized actions.