CVE-2026-92797
Last modified
CVE-2026-92797 is a high-severity vulnerability rated 8.8/10 on the CVSS scale. The MemberPress plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 1.14.1. This is due to a bypassable nonce verification check in the save_profile_fields() function that uses an isset() condition at line 1119, allowing the security check to be completely bypassed by simply omitting the nonce parameter from the request. EPSS estimates a 0.15% chance of exploitation in the next 30 days.
Description
The MemberPress plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 1.14.1. This is due to a bypassable nonce verification check in the save_profile_fields() function that uses an isset() condition at line 1119, allowing the security check to be completely bypassed by simply omitting the nonce parameter from the request. This makes it possible for unauthenticated attackers to change authenticated users' email addresses via a forged request granted they can trick an authenticated user into performing an action such as clicking on a link, leading to account takeover through password reset functionality.
Metrics
Weakness Enumeration
Affected Software
Source: CNA advisory (CVE.org). NVD analysis pending.
| Vendor | Product | Versions |
|---|---|---|
| MemberPress | Memberpress | <= 1.14.1 |
References
Timeline
- Published
- Last Modified
- Status
- Deferred
Frequently Asked Questions
What is CVE-2026-92797?
How severe is CVE-2026-92797?
How do I fix CVE-2026-92797?
How Strix Helps
- How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
- Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
- PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
- AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.
Related CVEs from 2026
- CVE-2026-92791Uber Kraken through 0.1.29 fails to validate the tag paramet…7.5
- CVE-2026-92792OpenNHP through 1.0.2 selects its trusted-execution attestat…7.5
- CVE-2026-92793GoAdmin through 1.2.26 fails to properly anchor the logout p…8.1
- CVE-2026-92794OpenSign through 2.41.3 fails to validate caller identity in…7.5
- CVE-2026-92795Coze Studio through 0.5.1 fails to restrict the server URL s…6.5
- CVE-2026-92796Manticore Search versions 27.0.0 before 28.4.4 fail to valid…8.8
- CVE-2026-92798The User Registration & Membership plugin for WordPress is v…8.1
- CVE-2026-92799The Online Scheduling and Appointment Booking System – Bookl…5.3
- CVE-2026-9280The Ad Inserter – Ad Manager & AdSense Ads plugin for WordPr…6.1
- CVE-2026-92800Docs before 5.4.1 fails to properly revoke websocket collabo…6.8
- CVE-2026-92801cc-connect through 1.5.0 fails to enforce per-user allowlist…8.8
- CVE-2026-92802kan through 0.6.0 fails to properly validate board creation …4.3
Are you affected by CVE-2026-92797?
Run a free Strix scan to check your systems for this vulnerability.
Scan your code nowSource: NVD / NIST