WCFM Membership – WooCommerce Memberships for Multivendor Marketplace

WCFM Membership – WooCommerce Memberships for Multivendor Marketplace has 9 disclosed vulnerabilities in the WordSec catalog, reported between 2023 and 2026; all 9 are fixed as of September 2026. Their average CVSS score is 6.9, and the most serious one scores 9.8 out of 10. Severity breakdown: 2 critical and 2 high. 2026 was the busiest year with 5 disclosures.

The most common weakness is Missing Authorization, behind 4 of the records (44%). Other recurring categories include Authorization Bypass Through User-Controlled Key, Cross-Site Request Forgery (CSRF).

Every one of the 9 issues recorded for WCFM Membership – WooCommerce Memberships for Multivendor Marketplace has a vendor fix available, so running the current release closes all known holes.

7 independent researchers contributed these findings, most of them (3) reported by Chloe Chamberland. WCFM Membership – WooCommerce Memberships for Multivendor Marketplace is installed on roughly 10,000 WordPress sites, so each unpatched flaw has a wide blast radius. The current release is tested up to WordPress 7.0.4.

Strategic Overview

Avg CVSSMedium
6.9/ 10
Patch Coverage100%
Open

0

Fixed

9

Get automatic notifications for all WCFM Membership – WooCommerce Memberships for Multivendor Marketplace vulnerabilities before they are exploited.

Highest severity on recordCVSS 9.8CVE-2023-2276

WCFM Membership – WooCommerce Memberships for Multivendor Marketplace <= 2.10.7 - Unauthenticated Insecure Direct Object Reference to Arbitrary User Password Change

Read the full analysis

Vulnerability Records

9 records
2026-09-04 00:00CVE-2026-32480
5.3
Medium
Sebastian AlbrechtYes
2026-09-02 00:00CVE-2026-84756
6.3
Medium
yagamimoonYes
2026-07-07 23:34CVE-2026-3688
8.1
High
Osvaldo Noe Gonzalez Del Rio (Os)Yes
2026-05-29 00:00CVE-2026-42753
5.3
Medium
0xzenkoYes
2026-02-09 11:17CVE-2025-15147
4.3
Medium
Jing Xuan SunYes
2023-05-03 00:00CVE-2023-2276
9.8
Critical
István MártonYes
2023-04-05 00:00CVE-2022-4939
9.8
Critical
Chloe ChamberlandYes
2023-04-05 00:00CVE-2022-4941
6.3
Medium
Chloe ChamberlandYes
2023-04-05 00:00CVE-2022-4940
7.3
High
Chloe ChamberlandYes
Showing 1–9 of 9 reports
WCFM Membership – WooCommerce Memberships for Multivendor Marketplace banner
Latestv2.12.0

WCFM Membership – WooCommerce Memberships for Multivendor Marketplace

WC Lovers

Author

WC Lovers

4.0(25)
80/100
Last Updated
2026-08-30 (14d ago)
Active Installs
10,000+
Downloads
923,428
Requires WP
5.5+
Requires PHP
5.6+
Tested up to
WP 7.0.4
Created
2017-12-14 (9y ago)

A simple woocommerce memberships plugin for offering FREE AND PREMIUM SUBSCRIPTION for your multi-vendor marketplace (WCFM Marketplace, WC Vendors, WC Product Vendors & Dokan). You may set up unlimited membership levels (example: free, silver, gold etc) with different pricing plan, capabilities and commission. Documentations:- WCFM – Membership Video Tutorials Experience membership subscription here – Membership Demo HAVE SUPPORT OF MY MULTI-VENDOR WooCommerce Multivaendor Membership works with all popular marketplace add-ons – 🔖 WooCommerce Multivendor Marketplace 🔖 WC Vendors and WC Vednors PRO 🔖 Dokan Lite and Dokan PRO 🔖 WooCommerce Product Vendors HAVE FREE AND PAID MEMBERSHIPS You can configure it to have free and/or paid memberships on your site. Paid membership payment is handled securely via PayPal. Both one time and recurring/subscription payments are supported. HAVE SUPPORT OF MY PAYMENT GATEWAYS You can setup membsership subsctiptions with all flexibilities and with different intgegrated payment options as well – 👉 FREE 👉 PayPal 👉 Bank Transfer 👉 Stripe (3D Secure & SCA Compatible) Are you missing your payment gateway then setup using WC Products – HAVE DIFFERENT COMMISSION MODEL You can configure different commission structure for each membership level. Fixed and percent both are supported. HAVE DIFFERENT CAPABILITIES You can assign different capability module for each membership level. You may create totally different capability group with all flexibilities (example: product limit, categories, product types etc) for each membership level. But this is not directly part of this add-on, Capability modules are come from WCFM – Groups & Staffs. Registration OTP Veirification 👨 Indian Users – https://wordpress.org/plugins/sms-alert/ 👨 Other Users – https://woocommerce.com/products/twilio-sms-notifications/ MEMBERSHIP DETAILS Your vednors will have full details of their membership under their WCFM dashboard. They may also change their subscription plan any time – upgrade or downgrade. WHAT ABOUT NON-VENDOR USERS Any user of the site (except Administrator and Shop manager) may apply for membership subscription. Pay for Product Option This will allow you to setup a system where vendor has to pay before adding a product – Just to mention, it works as a add-on for WooCommerce Frontend Manager. Translations Potuguese (Thanks to Rafael Sartori) Spanish (Thanks to @ffthernandez) German (Thanks to Ciao) Feedback All we want is love. We are extremely responsive about support requests – so if you face a problem or find any bugs, shoot us a mail or post it in the support forum, and we will respond within 6-12 hours(during business days). If you get the impulse to rate the plugin low because it is not working as it should, please do wait for our response because the root cause of the problem may be something else. It is extremely disheartening when trigger happy users downrate a plugin for no fault of the plugin. Feel free to reach us either via our support forum or WordPress.org, happy to serve anything you looking for. Really proud to serve and enhance WooCommerce. Be with us … Team WC Lovers

Vulnerability data © Defiant, Inc., provided under the Wordfence Intelligence T&C