Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
5.3
CVE-2026-4604: Klubraum Membership Request plugin settings can be hijacked
CVE-2026-4604 · published 3 months ago
Summary
The Klubraum Membership Request plugin for WordPress is vulnerable to unauthorized changes to its settings, which could allow attackers to take control of the plugin's integration with the Klubraum service. This affects all versions of the plugin up to 1.1.0. To fix this, update the plugin to the latest version.
Original advisory text
The Klubraum Membership Request plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the `kr_mr_store_settings()` function in all versions up...
The Klubraum Membership Request plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the `kr_mr_store_settings()` function in all versions up to, and including, 1.1.0. This makes it possible for unauthenticated attackers to update the plugin's settings, including the Klubraum API token and introduction text, effectively hijacking the plugin's integration with the Klubraum service.
References
- https://plugins.trac.wordpress.org/browser/klubraum-membership-request/tags/1.1....
- https://plugins.trac.wordpress.org/browser/klubraum-membership-request/tags/1.1....
- https://plugins.trac.wordpress.org/browser/klubraum-membership-request/trunk/adm...
- https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&new...
- https://www.wordfence.com/threat-intel/vulnerabilities/id/09e158d2-f9a6-41a6-a91...
Internet-facing
14 days
Internal
60 days
- Not known to be exploited
- Can be exploited automatically
- Gives an attacker partial control
Type
CWE-862Missing Authorization
Timeline
Published29 Jul 2026
Updated4 Nov 2026
First seen29 Jul 2026
Sources
CVE-2026-4604 · NVD
Track software like this
Free during beta