CVE-2026-92797

{
  "id": "CVE-2026-92797",
  "sourceIdentifier": "[email protected]",
  "published": "2026-10-28T08:16:30.250",
  "lastModified": "2026-11-04T23:10:00.223",
  "vulnStatus": "Deferred",
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "The MemberPress plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 1.14.1. This is due to a bypassable nonce verification check in the save_profile_fields() function that uses an isset() condition at line 1119, allowing the security check to be completely bypassed by simply omitting the nonce parameter from the request. This makes it possible for unauthenticated attackers to change authenticated users' email addresses via a forged request granted they can trick an authenticated user into performing an action such as clicking on a link, leading to account takeover through password reset functionality."
    },
    {
      "lang": "es",
      "value": "El plugin MemberPress para WordPress es vulnerable a falsificación de petición en sitios cruzados (CSRF) en versiones hasta la 1.14.1 incluida. Esto se debe a una verificación de nonce eludible en la función save_profile_fields() que utiliza una condición isset() en la línea 1119, lo que permite que la verificación de seguridad sea completamente eludida simplemente omitiendo el parámetro nonce de la petición. Esto hace posible que atacantes no autenticados cambien las direcciones de correo electrónico de usuarios autenticados mediante una petición falsificada, siempre que puedan engañar a un usuario autenticado para que realice una acción como hacer clic en un enlace, lo que lleva a la toma de control de la cuenta a través de la funcionalidad de restablecimiento de contraseña."
    }
  ],
  "affected": [
    {
      "source": "[email protected]",
      "affectedData": [
        {
          "vendor": "MemberPress",
          "product": "Memberpress",
          "defaultStatus": "unaffected",
          "versions": [
            {
              "version": "0",
              "lessThanOrEqual": "1.14.1",
              "versionType": "semver",
              "status": "affected"
            }
          ]
        }
      ]
    }
  ],
  "metrics": {
    "cvssMetricV31": [
      {
        "source": "[email protected]",
        "type": "Secondary",
        "cvssData": {
          "version": "3.1",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
          "baseScore": 8.8,
          "baseSeverity": "HIGH",
          "attackVector": "NETWORK",
          "attackComplexity": "LOW",
          "privilegesRequired": "NONE",
          "userInteraction": "REQUIRED",
          "scope": "UNCHANGED",
          "confidentialityImpact": "HIGH",
          "integrityImpact": "HIGH",
          "availabilityImpact": "HIGH"
        },
        "exploitabilityScore": 2.8,
        "impactScore": 5.9
      }
    ],
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "timestamp": "2026-10-29T01:28:36.326474Z",
          "id": "CVE-2026-92797",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "total"
            }
          ],
          "role": "CISA Coordinator",
          "version": "2.0.3"
        }
      }
    ]
  },
  "weaknesses": [
    {
      "source": "[email protected]",
      "type": "Secondary",
      "description": [
        {
          "lang": "en",
          "value": "CWE-352"
        }
      ]
    }
  ],
  "references": [
    {
      "url": "https://memberpress.com/change-log/#1.14.2",
      "source": "[email protected]"
    },
    {
      "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/2fb6cdd0-cd48-49a5-b998-f1c3fbdc25f7?source=cve",
      "source": "[email protected]"
    }
  ]
}