{"id":"CVE-2026-12967","published":"2026-11-06T06:16:42.560","lastModified":"2026-11-06T06:16:42.560","description":"The WCFM Membership  WordPress plugin before 2.12.1 does not verify that payment was made before completing a paid membership, allowing any authenticated Subscriber/Customer to activate a paid vendor membership for free and gain the marketplace vendor role.","cvssScore":null,"cvssSeverity":null,"cvssVector":null,"cwes":[],"vendors":[],"products":[],"references":[{"url":"https://wpscan.com/vulnerability/37e7aff5-19fd-480c-87f5-e1863a99d8b6/","tags":[]}],"exploitRefs":[],"hasPoc":false,"ai":null}