Vulnerability · Published Feb 9, 2026 · Assigned by Wordfence

CVE-2025-15147WCFM Membership – WooCommerce Memberships for Multivendor Marketplace <= 2.11.8 - Insecure Direct Object Reference to Update Membership Payment

Medium 4.3

In plain English

A medium-severity authorization bypass via user-controlled key in WCFM Membership – WooCommerce Memberships for Multivendor Marketplace from wclovers. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.3% (higher than 21% of all known vulnerabilities).

Severity (CVSS 3.1)4.3Medium

Exploit odds (30 days)0.3%top 79.0% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

The WCFM Membership – WooCommerce Memberships for Multivendor Marketplace plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 2.11.8 via the 'WCFMvm_Memberships_Payment_Controller::processing' due to missing validation on a user controlled key. This makes it possible for authenticated attackers, with Subscriber-level access and above, to modify other users' membership payments.

Affected products (as reported)

Vendor	Product	Versions
wclovers	WCFM Membership – WooCommerce Memberships for Multivendor Marketplace	0 – through 2.11.8

Weakness: CWE-639 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N

In plain English

Official description

Affected products (as reported)

References