Get real-time updates on Telegram
CVE-2026-19709: Membership For WooCommerce 0 to before 3.1.2
CVE-2026-19709. CVSS 3.1 base score 5.3 (MEDIUM, Source advisory). EPSS 0.00323 (percentile 0.24006), scored 21-Oct-2026.
Affected technology
Membership For WooCommerce · 0 to before 3.1.2
Vendor not specified by the source
Description’s affected range: before 3.1.2 does not check that an API consumer secret
Component: Not specified by the source
Attack conditions (Source advisory, CVSS 3.1): Network (remote) · No privileges required · No user interaction required
What an attacker can do
Unauthenticated attackers can reach its REST routes and disclose any user's membership plan details on sites where the API has been enabled but no keys were ever generated. Source advisory’s CVSS 3.1 assessment (base score 5.3/10) rates confidentiality impact as low; integrity and availability impact as none.
- CWE
- CWE-287
- CCR priority
- 21.3 /100 (P4)
- CVSS 3.1
- 5.3 /10 · CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N · Source advisory
- EPSS
- 0.00323 · percentile 0.24006 · 2026-10-21
- KEV
- no
Provenance
- NVD CVE API 2.0 · Source record · observed 2026-10-22 20:50:20.011821+00:00 UTC
Stable permalink: https://cybercodered.org/item/cve-cve-2026-19709.html