CVE-2026-84756: CWE-266 Incorrect Privilege Assignment in WC Lovers WCFM Membership

This vulnerability (CVE-2026-84756) affects WC Lovers WCFM Membership versions up to 2.11.11 and involves incorrect privilege assignment (CWE-266) that allows subscriber privilege escalation. The CVSS 3.1 score is 7.1, indicating a high severity with network attack vector, low attack complexity, and requiring low privileges but no user interaction. The impact includes limited confidentiality loss and high integrity impact, with no availability impact. No vendor advisory or patch information is currently provided, and no known active exploitation has been reported.

An attacker with subscriber-level privileges can escalate their privileges, potentially gaining unauthorized access to higher-level functions or data within the WCFM Membership system. This could lead to unauthorized modification of data or actions that compromise system integrity. Confidentiality impact is limited but present, while availability is not affected.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, monitor vendor communications for updates. No specific temporary mitigations are provided.