IT SBIT Services
Schneeberger
DEEN
CVE tracker

MemberPress: Cross-Site Request Forgery enables email change and account takeover

CVE-2026-92797High 8.8

← All vulnerabilities

Summary

The MemberPress WordPress plugin up to and including version 1.14.1 does not properly verify the nonce in the save_profile_fields() function, so the check can be skipped by omitting the nonce parameter. An unauthenticated attacker can forge a request that changes the email address of a logged-in user, for example after tricking that user into clicking a link. The attacker can then use the password reset function to take over the account. The NVD/CNA score is 8.8 (high), while VulDB scores it 4.3 (medium).

Affected

  • MemberPress up to and including 1.14.1 (per the Wordfence/CNA description)
  • VulDB lists 1.14.0 and 1.14.1
  • Unknown: whether versions before 1.14.0 are affected

Fixed in

  • Not independently confirmed. The CVE references point to the MemberPress changelog entry for 1.14.2, which does not name this CVE.
  • Recommended target: 1.14.3 or newer, per the vendor's update guidance.

Workaround

  • No vendor workaround found. Updating is the primary fix.
  • Until the update is installed: ask users to log out of WordPress when not in use and to avoid clicking links while logged in.
  • Have administrators use a separate browser profile for WordPress administration.
  • Review email change events and look for unexpected address changes, especially on administrator accounts.

Exploitation

  • Not listed in CISA KEV.
  • CISA SSVC assessment: exploitation none, not automatable, total technical impact.
  • No exploitation evidence in the OffSeq honeypot data.
  • No public proof of concept detected by one tracker (secondary source, to be re-checked).
  • EPSS: 0.15 %.

Our recommendation

  • Update MemberPress to version 1.14.3 or newer, using the official MemberPress account and not unofficial mirrors.
  • Until then, restrict logins for administrators and check user accounts for unexpected email address changes.
  • Make sure the email accounts behind WordPress users are protected with strong multi-factor authentication, since a password reset is the takeover path.
  • Monitor for exploitation and re-check the vendor and Wordfence advisories for the fixed-version statement.

Public exploits

PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.

Research sources

Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 31 Oct 2026, 09:37.

Original description (NVD)

The MemberPress plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 1.14.1. This is due to a bypassable nonce verification check in the save_profile_fields() function that uses an isset() condition at line 1119, allowing the security check to be completely bypassed by simply omitting the nonce parameter from the request. This makes it possible for unauthenticated attackers to change authenticated users' email addresses via a forged request granted they can trick an authenticated user into performing an action such as clicking on a link, leading to account takeover through password reset functionality.

NVD references (2)

Sources

The tracker combines official, freely usable data sources – updated continuously:

This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.

Affected? We can help.

We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.

Get in touchRSS feed