PLUGIN SECURITY
Is Wc Multivendor Membership safe?
A simple woocommerce memberships plugin for offering free and premium subscription for your multi-vendor marketplace - WCFM Marketplace, WC Vendors &a …
What this plugin does
- Slug:
wc-multivendor-membership - Author: WC Lovers
- 10000+ active installs
- 80/100 rating (25 reviews on wordpress.org)
- 936232 all-time downloads
- On WordPress.org since 2017-12-14
membersmulti vendormultivendor marketplacesubscriptionwoocommerce membership
Maintenance status
- Last updated: 2026-11-02 9:04am GMT
- Tested up to WordPress: 7.1.4
- Requires PHP: 5.6+
- Max supported PHP (analyzed): 8.4
Known vulnerabilities
14 known CVEs on file for Wc Multivendor Membership. Reported between 2023 and 2026.
| CVE | Vulnerability | Type | Severity | Affected | Fixed in | Published | Status |
|---|---|---|---|---|---|---|---|
| CVE-2026-39744 | WCFM Membership – WooCommerce Memberships for Multivendor Marketplace [wc-multivendor-membership] < 2.12.1 | — | High 7.1 | < 2.12.1 | 2.12.1 | 2026-11-06 | — |
| CVE-2026-12967 | WCFM Membership – WooCommerce Memberships for Multivendor Marketplace [wc-multivendor-membership] < 2.12.1 | Improper Privilege Management | Unknown | < 2.12.1 | 2.12.1 | 2026-11-06 | — |
| CVE-2026-61990 | WCFM Membership – WooCommerce Memberships for Multivendor Marketplace [wc-multivendor-membership] < 2.12.1 | Missing Authorization | Medium 4.3 | < 2.12.1 | 2.12.1 | 2026-11-04 | — |
| CVE-2026-39777 | WCFM Membership – WooCommerce Memberships for Multivendor Marketplace [wc-multivendor-membership] < 2.12.1 | — | Medium 4.3 | < 2.12.1 | 2.12.1 | 2026-11-03 | — |
| CVE-2026-39743 | WCFM Membership – WooCommerce Memberships for Multivendor Marketplace [wc-multivendor-membership] < 2.12.1 | — | Medium 5.3 | < 2.12.1 | 2.12.1 | 2026-11-03 | — |
| CVE-2026-84756 | WCFM Membership – WooCommerce Memberships for Multivendor Marketplace [wc-multivendor-membership] < 2.12.0 | Incorrect Privilege Assignment | High 7.1 | < 2.12.0 | 2.12.0 | 2026-09-03 | — |
| CVE-2026-32480 | WCFM Membership – WooCommerce Memberships for Multivendor Marketplace [wc-multivendor-membership] < 2.12.0 | Missing Authorization | Medium 5.3 | < 2.12.0 | 2.12.0 | 2026-09-02 | — |
| CVE-2026-3688 | WCFM Membership – WooCommerce Memberships for Multivendor Marketplace [wc-multivendor-membership] < 2.11.11 | Authorization Bypass Through User-Controlled Key | High 8.1 | < 2.11.11 | 2.11.11 | 2026-07-07 | — |
+ 6 more known vulnerabilities
| CVE | Vulnerability | Type | Severity | Affected | Fixed in | Published | Status |
|---|---|---|---|---|---|---|---|
| CVE-2026-42753 | WCFM Membership – WooCommerce Memberships for Multivendor Marketplace [wc-multivendor-membership] < 2.11.11 | — | High 7.3 | < 2.11.11 | 2.11.11 | 2026-05-27 | — |
| CVE-2025-15147 | WCFM Membership – WooCommerce Memberships for Multivendor Marketplace [wc-multivendor-membership] < 2.11.9 | Authorization Bypass Through User-Controlled Key | Medium 4.3 | < 2.11.9 | 2.11.9 | 2026-02-09 | — |
| CVE-2023-2276 | WCFM Membership – WooCommerce Memberships for Multivendor Marketplace [wc-multivendor-membership] < 2.11.0 | Authorization Bypass Through User-Controlled Key | Critical 9.8 | < 2.11.0 | 2.11.0 | 2023-05-03 | — |
| CVE-2022-4939 | WCFM Membership – WooCommerce Memberships for Multivendor Marketplace [wc-multivendor-membership] < 2.10.1 | Missing Authorization | Critical 9.8 | < 2.10.1 | 2.10.1 | 2023-04-05 | — |
| CVE-2022-4940 | WCFM Membership – WooCommerce Memberships for Multivendor Marketplace [wc-multivendor-membership] < 2.10.1 | Missing Authorization | Medium 6.5 | < 2.10.1 | 2.10.1 | 2023-04-05 | — |
| CVE-2022-4941 | WCFM Membership – WooCommerce Memberships for Multivendor Marketplace [wc-multivendor-membership] < 2.10.1 | Cross-Site Request Forgery (CSRF) | High 8.8 | < 2.10.1 | 2.10.1 | 2023-04-05 | — |
How to fix it
Update this plugin to the latest release from wordpress.org — each CVE above lists the exact release that fixed it ("Fixed in") when one is on file.
This is the plugin's full known vulnerability history, not a scan of any specific installation — run a free scan of your own site to check your exact installed version.
Safer / more established alternatives
- BuddyPress — 90000+ active installs — 82/100 (375) — max PHP <8.0
- Simple Membership — 40000+ active installs — 92/100 (477) — max PHP 8.4
- Dokan: AI Powered WooCommerce Multivendor Marketplace Solution – Build Your Own Amazon, eBay, Etsy — 30000+ active installs — 92/100 (769) — max PHP <8.0
- WCFM – Frontend Manager for WooCommerce — 20000+ active installs — 90/100 (286) — max PHP 8.4
- Simple Membership After Login Redirection — 10000+ active installs — 96/100 (15)
Check your own WordPress site
Run a free passive scan now, or create a free account and install the WP Clinic plugin for a deep scan of your whole hosting account and AI-assisted repair.