CVE-2026-92797

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-92797", "assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "state": "PUBLISHED", "assignerShortName": "Wordfence", "dateReserved": "2026-09-16T19:42:26.863Z", "datePublished": "2026-10-28T07:48:28.598Z", "dateUpdated": "2026-10-29T01:41:50.240Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "shortName": "Wordfence", "dateUpdated": "2026-10-28T07:48:28.598Z"}, "affected": [{"vendor": "MemberPress", "product": "Memberpress", "versions": [{"version": "0", "status": "affected", "lessThanOrEqual": "1.14.1", "versionType": "semver"}], "defaultStatus": "unaffected"}], "descriptions": [{"lang": "en", "value": "The MemberPress plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 1.14.1. This is due to a bypassable nonce verification check in the save_profile_fields() function that uses an isset() condition at line 1119, allowing the security check to be completely bypassed by simply omitting the nonce parameter from the request. This makes it possible for unauthenticated attackers to change authenticated users' email addresses via a forged request granted they can trick an authenticated user into performing an action such as clicking on a link, leading to account takeover through password reset functionality."}], "title": "Memberpress <= 1.14.1 - Cross-Site Request Forgery via 'user_email' Parameter", "references": [{"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/2fb6cdd0-cd48-49a5-b998-f1c3fbdc25f7?source=cve"}, {"url": "https://memberpress.com/change-log/#1.14.2"}], "problemTypes": [{"descriptions": [{"lang": "en", "description": "CWE-352 Cross-Site Request Forgery (CSRF)", "cweId": "CWE-352", "type": "CWE"}]}], "metrics": [{"cvssV3_1": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "baseScore": 8.8, "baseSeverity": "HIGH"}}], "credits": [{"lang": "en", "type": "finder", "value": "Matthew Cowan"}], "timeline": [{"time": "2026-09-16T19:58:38.000Z", "lang": "en", "value": "Vendor Notified"}, {"time": "2026-10-27T00:00:00.000Z", "lang": "en", "value": "Disclosed"}]}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-92797", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2026-10-29T01:28:36.326474Z"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-10-29T01:41:50.240Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-92797", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2026-10-29T01:28:36.326474Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-10-29T01:37:04.340Z"}}], "cna": {"title": "Memberpress <= 1.14.1 - Cross-Site Request Forgery via 'user_email' Parameter", "credits": [{"lang": "en", "type": "finder", "value": "Matthew Cowan"}], "metrics": [{"cvssV3_1": {"version": "3.1", "baseScore": 8.8, "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H"}}], "affected": [{"vendor": "MemberPress", "product": "Memberpress", "versions": [{"status": "affected", "version": "0", "versionType": "semver", "lessThanOrEqual": "1.14.1"}], "defaultStatus": "unaffected"}], "timeline": [{"lang": "en", "time": "2026-09-16T19:58:38.000Z", "value": "Vendor Notified"}, {"lang": "en", "time": "2026-10-27T00:00:00.000Z", "value": "Disclosed"}], "references": [{"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/2fb6cdd0-cd48-49a5-b998-f1c3fbdc25f7?source=cve"}, {"url": "https://memberpress.com/change-log/#1.14.2"}], "descriptions": [{"lang": "en", "value": "The MemberPress plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 1.14.1. This is due to a bypassable nonce verification check in the save_profile_fields() function that uses an isset() condition at line 1119, allowing the security check to be completely bypassed by simply omitting the nonce parameter from the request. This makes it possible for unauthenticated attackers to change authenticated users' email addresses via a forged request granted they can trick an authenticated user into performing an action such as clicking on a link, leading to account takeover through password reset functionality."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-352", "description": "CWE-352 Cross-Site Request Forgery (CSRF)"}]}], "providerMetadata": {"orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "shortName": "Wordfence", "dateUpdated": "2026-10-28T07:48:28.598Z"}}}, "cveMetadata": {"cveId": "CVE-2026-92797", "state": "PUBLISHED", "dateUpdated": "2026-10-29T01:41:50.240Z", "dateReserved": "2026-09-16T19:42:26.863Z", "assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "datePublished": "2026-10-28T07:48:28.598Z", "assignerShortName": "Wordfence"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "Memberpress", "vendor": "MemberPress", "versions": [{"lessThanOrEqual": "1.14.1", "status": "affected", "version": "0", "versionType": "semver"}]}], "source": "security@wordfence.com"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "The MemberPress plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 1.14.1. This is due to a bypassable nonce verification check in the save_profile_fields() function that uses an isset() condition at line 1119, allowing the security check to be completely bypassed by simply omitting the nonce parameter from the request. This makes it possible for unauthenticated attackers to change authenticated users' email addresses via a forged request granted they can trick an authenticated user into performing an action such as clicking on a link, leading to account takeover through password reset functionality."}, {"lang": "es", "value": "El plugin MemberPress para WordPress es vulnerable a falsificaci\u00f3n de petici\u00f3n en sitios cruzados (CSRF) en versiones hasta la 1.14.1 incluida. Esto se debe a una verificaci\u00f3n de nonce eludible en la funci\u00f3n save_profile_fields() que utiliza una condici\u00f3n isset() en la l\u00ednea 1119, lo que permite que la verificaci\u00f3n de seguridad sea completamente eludida simplemente omitiendo el par\u00e1metro nonce de la petici\u00f3n. Esto hace posible que atacantes no autenticados cambien las direcciones de correo electr\u00f3nico de usuarios autenticados mediante una petici\u00f3n falsificada, siempre que puedan enga\u00f1ar a un usuario autenticado para que realice una acci\u00f3n como hacer clic en un enlace, lo que lleva a la toma de control de la cuenta a trav\u00e9s de la funcionalidad de restablecimiento de contrase\u00f1a."}], "id": "CVE-2026-92797", "lastModified": "2026-11-04T23:10:00.223", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 8.8, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 2.8, "impactScore": 5.9, "source": "security@wordfence.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-92797", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "total"}], "role": "CISA Coordinator", "timestamp": "2026-10-29T01:28:36.326474Z", "version": "2.0.3"}}]}, "published": "2026-10-28T08:16:30.250", "references": [{"source": "security@wordfence.com", "url": "https://memberpress.com/change-log/#1.14.2"}, {"source": "security@wordfence.com", "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/2fb6cdd0-cd48-49a5-b998-f1c3fbdc25f7?source=cve"}], "sourceIdentifier": "security@wordfence.com", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-352"}], "source": "security@wordfence.com", "type": "Secondary"}]}

{}

{"created": "2026-10-28T09:30:20.167742+00:00", "updated": "2026-10-28T09:30:20.167747+00:00", "vendors": []}