CVE-2026-61994: Missing Authorization in RocketGeek WP-Members

The vulnerability identified as CVE-2026-61994 affects the WP-Members plugin by RocketGeek. It is caused by missing authorization checks that result in incorrectly configured access control security levels. This can allow an attacker with limited privileges to perform actions or access data beyond their authorization scope. The affected versions include all releases up to and including 3.5.7. The CVSS v3.1 base score is 5.4, indicating a medium severity issue with network attack vector, low attack complexity, low privileges required, no user interaction, unchanged scope, and limited confidentiality and integrity impact.

An attacker with low privileges can exploit this vulnerability to bypass access control restrictions, potentially gaining unauthorized read or write access to data or functionality within the WP-Members plugin. The impact is limited to confidentiality and integrity with no availability impact. There are no known exploits in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. No official fix or patch links are provided in the available data. Until a patch is available, review and tighten access control configurations in WP-Members to minimize exposure.