CVE-2026-92797 Memberpress <= 1.14.1 - Cross-Site Request Forgery via 'user_email' Parameter
- Exploited in the wild
- Not known
- Fix
- None listed
What is CVE-2026-92797?
CVE-2026-92797 is a high-severity vulnerability in Memberpress, published on 28 Oct 2026.
Official description
The MemberPress plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 1.14.1. This is due to a bypassable nonce verification check in the save_profile_fields() function that uses an isset() condition at line 1119, allowing the security check to be completely bypassed by simply omitting the nonce parameter from the request. This makes it possible for unauthenticated attackers to change authenticated users' email addresses via a forged request granted they can trick an authenticated user into performing an action such as clicking on a link, leading to account takeover through password reset functionality.
Weakness: CWE-352
Which versions are affected by CVE-2026-92797?
How do I fix CVE-2026-92797?
No fix has been published for CVE-2026-92797 yet. Limit exposure of the affected software until one is available.
Is CVE-2026-92797 being exploited?
There is no known exploitation of CVE-2026-92797 in the wild and no public exploit code.
Sources
Also known as GHSA-wc55-5qpx-prwh.