CVE-2026-4604 describes a missing capability check in the kr_mr_store_settings() function of the Klubraum Membership Request WordPress plugin, affecting all versions up to and including 1.1.0. Due to this missing authorization control, unauthenticated attackers can update critical plugin settings, including the Klubraum API token and introduction text. This unauthorized modification can lead to hijacking the plugin's integration with the Klubraum service. The vulnerability is identified as CWE-862 and has a medium CVSS score of 5.3. No patch or official remediation has been published as of the data provided.

An attacker without authentication can modify sensitive plugin settings, such as the Klubraum API token, which may allow them to hijack the plugin's integration with the Klubraum service. This could lead to unauthorized control over plugin behavior or data sent to the Klubraum service. The vulnerability does not impact confidentiality or availability directly but impacts integrity of plugin configuration.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, restrict access to the plugin's settings endpoints and monitor for unauthorized changes. Avoid exposing the plugin's administrative functions to unauthenticated users.