CVE-2026-103067

Summary

A Cross-Site Request Forgery (CSRF) vulnerability exists in the Memberful - Membership Plugin memberful-wp, allowing attackers to forge requests that the victim has already authenticated, potentially leading to unauthorized actions.

Exploitability

Exploitation requires the victim to be authenticated and interact with the affected plugin. The attacker must trick the victim into performing actions on their behalf, which can be difficult if proper anti-CSRF tokens are in place.

Blast radius

If exploited, the attacker could perform actions on behalf of the victim, such as changing membership details or making financial transactions, leading to significant data loss or financial harm.

Detection

No reliable host or network indicator is derivable from the published description.

Prioritized remediation

Upgrade to Memberful - Membership Plugin version 1.82.0 or later.

Analysis generated locally by qwen2.5:7b-instruct (no data left the box). AI-assisted — verify against primary sources before acting.