Missing Authorization vulnerability in RocketGeek WP-Members wp-members allows Exploiting Incorrectly Configured Access Control Security Levels.This… (CVE-2026-61994)

CVE-2026-61994 describes a missing authorization vulnerability in the WP-Members plugin by RocketGeek, affecting versions up to and including 3.5.7. The flaw involves incorrectly configured access control security levels, which can be exploited by an attacker with low privileges to gain unauthorized access to certain functionality or data. The vulnerability has a CVSS 3.1 base score of 5.4, indicating a medium severity impact primarily affecting confidentiality and integrity with no impact on availability. No vendor advisory or patch information is provided, so the patch status is not confirmed.

Exploitation of this vulnerability could allow an attacker with low privileges to bypass access control restrictions, potentially leading to unauthorized disclosure or modification of information within the WP-Members plugin context. There is no indication of availability impact or known active exploitation in the wild.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, review and correct access control configurations in WP-Members to ensure proper authorization enforcement. Avoid granting unnecessary privileges to users and monitor plugin updates from RocketGeek for patches addressing this issue.