CVE-2026-3688

The WCFM Membership – WooCommerce Memberships for Multivendor Marketplace plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 2.11.10. This is due to the 'wcfmvm_membership_change' AJAX action not validating user permission to modify other users. This makes it possible for authenticated attackers, with vendor level access and above, to change any user's role to 'wcfm_vendor' by changing their membership plan.

• CWE-639

• https://plugins.trac.wordpress.org/changeset/3520777/wc-multivendor-membership
• https://www.wordfence.com/threat-intel/vulnerabilities/id/8a934ccd-9330-4585-9994-838940d24980?source=cve

Published

Jul 8, 2026

Last Modified

Jul 8, 2026

Status

Deferred

• Uncovering a hidden BOLA in Appsmith's snapshot logicStrix autonomously discovered a BOLA/IDOR vulnerability in Appsmith's snapshot deletion path.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-36837TOTOLINK A3002RU V3 <= V3.0.0-B20220304.1804 was discovered …7.5
• CVE-2026-36841TOTOLINK N200RE V5 was discovered to contain a command injec…9.8
• CVE-2026-36848Gigamon GVOS v5.16.1 and below is vulnerable to Directory Tr…7.5
• CVE-2026-36872Sourcecodester Basic Library System v1.0 is vulnerable to SQ…2.7
• CVE-2026-36873Sourcecodester Basic Library System v1.0 is vulnerable to SQ…2.7
• CVE-2026-36874Sourcecodester Basic Library System v1.0 is vulnerable to SQ…2.7
• CVE-2026-3689OpenClaw Canvas Path Traversal Information Disclosure Vulner…6.5
• CVE-2026-3690OpenClaw Canvas Authentication Bypass Vulnerability. This vu…7.4
• CVE-2026-36906Cross Site Scripting vulnerability in iotgateway v.3.0.1 all…6.1
• CVE-2026-36907A stack overflow in the AP4_StsdAtom::AP4_StsdAtom component…5.5
• CVE-2026-36908A stack overflow in the AP4_Array<AP4_TrunAtom::Entry>::Ensu…5.5
• CVE-2026-36909A NULL pointer dereference in the AP4_TkhdAtom::GetTrackId()…6.2