WP Membership

WP Membership has 7 disclosed vulnerabilities in the WordSec catalog, reported between 2015 and 2026; 3 are fixed and 4 remain unpatched as of September 2026. Their average CVSS score is 7.3, and the most serious one scores 9.8 out of 10. Severity breakdown: 1 critical and 3 high. 2026 was the busiest year with 2 disclosures.

The most common weakness is Incorrect Privilege Assignment, behind 2 of the records (29%). Other recurring categories include Missing Authorization, Cross-Site Scripting.

3 of the records (43%) have a vendor fix, while 4 remain unpatched. The oldest unresolved one dates back to 2015.

5 independent researchers contributed these findings, most of them (2) reported by Panagiotis Vagenas.

Strategic Overview

Avg CVSSHigh

7.3/ 10

Patch Coverage43%

Open

Fixed

Get automatic notifications for all WP Membership vulnerabilities before they are exploited.

Most severe open issueCVSS 8.8CVE-2025-69292

Membership <= 1.6.4 - Authenticated (Subscriber+) Privilege Escalation

Read the full analysis

Vulnerability Records

7 records


2026-01-22 00:00	Membership <= 1.6.4 - Authenticated (Subscriber+) Privilege Escalation WP Membership <= 1.6.4	`CVE-2025-69292`	8.8 High	Phat RiO	No
2026-01-22 00:00	Membership <= 1.6.4 - Missing Authorization WP Membership <= 1.6.4	`CVE-2025-69193`	5.3 Medium	Phat RiO	No
2025-08-14 00:00	WP Membership <= 1.6.3 - Missing Authorization to Authenticated (Subscriber+) Settings Update WP Membership <= 1.6.3	`CVE-2025-54717`	4.3 Medium	João Pedro Soares de Alcântara	Yes
2024-11-08 18:58	WP Membership <= 1.6.2 - Unauthenticated Arbitrary File Upload WP Membership <= 1.6.2	`CVE-2024-10547`	9.8 Critical	Tonn	Yes
2023-03-06 00:00	Multiple E-plugins (Various Versions) - Authenticated (Subscriber+) Privilege Escalation WP Membership < 1.5.7	`CVE-2020-36666`	8.8 High	Omar Badran	Yes
2015-05-21 00:00	WP Membership <= 1.2.3 - Cross-Site Scripting WP Membership <= 1.2.3	`CVE-2015-4039`	5.4 Medium	Panagiotis Vagenas	No
2015-05-21 00:00	WP Membership <= 1.2.3 - Privilege Escalation WP Membership <= 1.2.3	`CVE-2015-4038`	8.8 High	Panagiotis Vagenas	No

Showing 1–7 of 7 reports