CVE-2026-4604CWE-862

Klubraum Membership Request <= 1.1.0 - Missing Authorization to Unauthenticated Arbitrary Plugin Settings Update

Medium · published July 29, 2026

CVSS v3.1
5.3
EPSS
0%
Percentile
33.1
In the wild
Unconfirmed
What it is

The Klubraum Membership Request plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the `kr_mr_store_settings()` function in all versions up to, and including, 1.1.0. This makes it possible for unauthenticated attackers to update the plugin's settings, including the Klubraum API token and introduction text, effectively hijacking the plugin's integration with the Klubraum service.

The record
Technical detail
CVSS v3.1
5.3 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
CVSS v4.0
Not supplied
EPSS
0.00403 · 33.1th percentile
Weakness
CWE-862 · Missing Authorization
Published
2026-07-29T09:31Z
EPSS history
Timeline
  • 29 JUL 09:31Z
    Klubraum Membership Request <= 1.1.0 - Missing Authorization to Unauthenticated Arbitrary Plugin Settings Update
    cvelistv5