Memberful Membership Plugin: Cross-Site Request Forgery (CSRF)

Summary

The Memberful - Membership Plugin (memberful-wp) for WordPress is affected by a Cross-Site Request Forgery vulnerability in all versions up to and including 1.81.0. An attacker can trick a logged-in user into clicking a malicious link or visiting a crafted page, causing unintended actions such as changing passwords or making purchases. Exploitation requires user interaction; the role needed is not confirmed in the sources.

Affected

• Memberful - Membership Plugin (memberful-wp) for WordPress, versions up to and including 1.81.0
• Versions from n/a through 1.81.0 according to the CNA record

Fixed in

• Version 1.81.1 is the first patched version according to Patchstack and the CNA
• The WordPress.org page lists 1.82.2 as the latest release at the time of research

Workaround

Unknown. No vendor-documented workaround was found. Patchstack advises updating the plugin immediately or asking the hosting provider or web developer for help.

Exploitation

• No confirmed in-the-wild exploitation found
• No public proof of concept found
• CISA SSVC: exploitation none, automatable no
• Patchstack rates the issue as Low priority with low impact and unlikely exploitation
• CISA KEV status not verified directly

Our recommendation

• Update the Memberful plugin to the latest release (at least 1.81.1) on every WordPress site
• Verify the installed version in the plugin list of each site
• After the update, check that the Memberful connection and administrator accounts work correctly
• Limit administrator and member sessions to trusted browsers and avoid clicking unknown links while logged in
• Monitor for unexpected password changes or purchases

Public exploits iAttack code is publicly available (PoC on GitHub, Metasploit or Exploit-DB).

PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.

Research sources

• Patchstack advisory for Memberful Membership Plugin up to 1.81.0 patchstack.com
• WordPress.org plugin page for Memberful - Membership Plugin wordpress.org
• Patchstack vulnerability list for memberful-wp patchstack.com
• Strix AI CVE mirror for CVE-2026-103067 www.strix.ai
• Memberful changelog memberful.com

Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 1 Nov 2026, 21:33.