wpeka-club — Vulnerabilities & Security Advisories 4

Wpeka-club is a WordPress plugin primarily used for creating and managing membership sites with subscription-based content access. Historically, it has been associated with multiple remote code execution (RCE) vulnerabilities, cross-site scripting (XSS) flaws, and privilege escalation issues, often stemming from insufficient input validation and improper access controls. The plugin's security posture has been compromised multiple times, with four CVEs recorded to date, highlighting recurring problems in sanitization and authentication mechanisms. These vulnerabilities have allowed attackers to execute arbitrary code, steal session cookies, and elevate privileges to administrative levels, posing significant risks to affected websites.