CVE-2026-28070: 
WordPress vulnerability analysis and mitigation

CVE-2026-28070 is a Missing Authorization (Broken Access Control) vulnerability in the WP eMember WordPress plugin developed by Tips and Tricks HQ. It allows unauthenticated remote attackers to exploit incorrectly configured access control security levels, potentially accessing restricted functionality or data. The vulnerability affects WP eMember versions up to and including v10.2.2, and was reported on October 14, 2025, by Tran Nguyen Bao Khanh of VCI - VNPT Cyber Immunity, with CVE assignment published on March 19, 2026. It carries a CVSS v3.1 base score of 5.3 (Medium) (Patchstack, Red Hat CVE).

The root cause is classified as CWE-862 (Missing Authorization), where one or more plugin functions fail to perform adequate authorization checks before executing privileged or sensitive operations (Patchstack). This is consistent with OWASP Top 10 category A5: Security Misconfiguration. The attack vector is network-based, requires no authentication, no user interaction, and low attack complexity — meaning any unauthenticated remote user can attempt exploitation. No public proof-of-concept code has been identified at this time.

Successful exploitation results in a limited confidentiality impact, allowing unauthenticated attackers to access data or functionality that should be restricted to authorized users. There is no integrity or availability impact based on the current CVSS assessment. The scope is limited to the affected WordPress installation, but in membership-based sites using WP eMember, exposed data could include member information or protected content (Patchstack).

No active in-the-wild exploitation has been reported, and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. The EPSS score is approximately 0.028% (0.000280), indicating a very low probability of exploitation in the near term (Feedly). Patchstack classifies this as low priority with low severity impact, noting it is unlikely to be exploited despite the potential for mass-exploit campaigns targeting WordPress plugins generally (Patchstack).

As of the time of disclosure, no official patch has been released by the plugin developer for WP eMember (Patchstack). Site administrators should monitor the WordPress plugin repository and the Tips and Tricks HQ website for an updated version beyond v10.2.2. In the interim, consider using a web application firewall (WAF) with WordPress-specific rulesets (such as Patchstack's virtual patching) to block exploitation attempts, or temporarily deactivating the plugin if membership functionality is not critical.

The vulnerability was discovered and responsibly disclosed by Tran Nguyen Bao Khanh of VCI - VNPT Cyber Immunity and reported through Patchstack on September 14, 2025, with public disclosure on October 14, 2025 (Patchstack). No significant broader media coverage or notable researcher commentary beyond the Patchstack advisory has been identified.