PT-2026-50361 · Tips Tricks Hq+1 · Wp-Emember

Tran Nguyen Bao Khanh · CVE-2026-54811 · Published 2026-06-16 · Updated 2026-06-17

Positive Technologies (AI Summary)

CVSS v3.1

9.3

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:L

Name of the Vulnerable Software and Affected Versions WP eMember versions prior to 10.9.4

Description The WP eMember plugin for WordPress contains a flaw allowing unauthenticated attackers to perform SQL Injection. This occurs due to insufficient escaping of user-supplied parameters and a lack of proper preparation of the SQL query, enabling the execution of additional queries to extract sensitive information from the database.

Recommendations Update to version 10.9.4 or later.

Fix

SQL injection

Weakness Enumeration

CWE-89

Related Identifiers

CVE-2026-54811

Affected Products

Wp-Emember

References · 4

• https://nvd.nist.gov/vuln/detail/CVE-2026-54811 · Security Note
• https://wordfence.com/threat-intel/vulnerabilities/id/db2b8c8d-2507-4325-ab65-ca71ba8da21f?source=api-prod · Note
• https://patchstack.com/database/wordpress/plugin/wp-emember/vulnerability/wordpress-wp-emember-plugin-v10-9-4-sql-injection-vulnerability?_s_id=cve · Note
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-54811 · Note