CVE-2025-15147 is an authorization bypass vulnerability in the WCFM Membership – WooCommerce Memberships for Multivendor Marketplace plugin for WordPress. The issue arises from the 'WCFMvm_Memberships_Payment_Controller::processing' function, which lacks proper validation of a user-controlled key. This allows authenticated attackers with at least Subscriber-level privileges to manipulate membership payment data belonging to other users. The vulnerability is categorized under CWE-639 (Insecure Direct Object Reference). The CVSS 3.1 base score is 4.3, indicating medium severity. The vulnerability affects all versions up to and including 2.11.8. There is no information about an available patch or vendor advisory at this time.

An authenticated user with Subscriber-level access or higher can modify membership payment information of other users due to missing validation on a user-controlled key. This could lead to unauthorized changes in membership payment records, potentially impacting membership management integrity. There is no indication of confidentiality or availability impact. No known exploits have been reported in the wild.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict user privileges to the minimum necessary and monitor for suspicious activity related to membership payment modifications. Avoid granting Subscriber-level or higher access to untrusted users. Follow updates from the vendor wclovers for any released patches or official mitigations.