{"id":"CVE-2026-103067","published":"2026-10-01T13:17:08.223","lastModified":"2026-10-01T14:34:35.357","description":"Cross-Site Request Forgery (CSRF) vulnerability in Memberful Memberful - Membership Plugin memberful-wp allows Cross Site Request Forgery.This issue affects Memberful - Membership Plugin: from n/a through 1.81.0.","cvssScore":8,"cvssSeverity":"HIGH","cvssVector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H","cwes":["CWE-352"],"vendors":[],"products":[],"references":[{"url":"https://patchstack.com/database/wordpress/plugin/memberful-wp/vulnerability/wordpress-memberful-membership-plugin-plugin-1-81-0-cross-site-request-forgery-csrf-vulnerability?_s_id=cve","tags":[]}],"exploitRefs":[],"hasPoc":false,"ai":{"summary":"A Cross-Site Request Forgery (CSRF) vulnerability exists in the Memberful - Membership Plugin memberful-wp, allowing attackers to forge requests that the victim has already authenticated, potentially leading to unauthorized actions.","exploitability":"Exploitation requires the victim to be authenticated and interact with the affected plugin. The attacker must trick the victim into performing actions on their behalf, which can be difficult if proper anti-CSRF tokens are in place.","blast_radius":"If exploited, the attacker could perform actions on behalf of the victim, such as changing membership details or making financial transactions, leading to significant data loss or financial harm.","remediation":"Upgrade to Memberful - Membership Plugin version 1.82.0 or later.","detection":"No reliable host or network indicator is derivable from the published description.","tags":["csrf","wp-plugin","auth"],"model":"qwen2.5:7b-instruct","analyzedAt":"2026-10-06T08:45:42.157Z"}}