What is CVE-2026-92797?

CVE-2026-92797 is a high-severity vulnerability in Memberpress, classified under Cross-Site Request Forgery (CSRF). CVSS score: 8.8/10. Published 2026-10-28.

How severe is CVE-2026-92797?

High severity. CVSS v3 base score is 8.8 out of 10.

CSRF in Memberpress

CVE-2026-92797

The MemberPress plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 1.14.1. This is due to a bypassable nonce verification check in the save_profile_fields() function that uses an isset() condition at line 1119, allowing the security check to be completely bypassed by simply omitting the nonce parameter from the request. This makes it possible for unauthenticated attackers to change authenticated users' email addresses via a forged request granted they can trick an authenticated user into performing an action such as clicking on a link, leading to account takeover through password reset functionality.

Vulnerability class: CSRF (Cross-Site Request Forgery)

Published 2026-10-28 · last modified 2026-10-29.

CVSS v3 metric

CVSS v3 base score 8.8 (High). Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H.

EPSS exploit prediction

EPSS: 0.001 (4.0th percentile), scored 2026-10-29.

Very low probability of exploitation in the next 30 days; routine patching cadence is appropriate. 4th percentile — 4.0% of CVEs in the catalogue have a lower EPSS than this one. How to read EPSS.

The 30-day trend appears once there are two daily scores.

Affected products

Memberpress

Weakness classification (CWE)

CWE-352 — Cross-Site Request Forgery (CSRF)

References

Frequently asked questions

What is CVE-2026-92797?: CVE-2026-92797 is a high-severity vulnerability in Memberpress, classified under Cross-Site Request Forgery (CSRF). CVSS score: 8.8/10. Published 2026-10-28.
How severe is CVE-2026-92797?: High severity. CVSS v3 base score is 8.8 out of 10.