Members <= 3.2.22 - Unauthenticated Sensitive Information Disclosure via REST API Pagination Side Channel
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- None
- Attack complexity
- Low
- Impact type
- Information disclosure
- Confidentiality · integrity · availability
- Low · None · None
- Fix status
- No fix listed
Attack profile from CVSS 3.1 · CNA. Fix status from CNA. Impact type from CWE-200.
Summary
The Members – Membership & User Role Editor Plugin plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 3.2.22 via the members_filter_protected_posts_for_rest. This makes it possible for unauthenticated attackers to extract determine the existence and exact count of access-restricted posts, and use per-page pagination as a boolean oracle to infer keywords and content contained within those hidden restricted posts.
Why it matters now
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- Yes
- Technical impact
- Partial
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| supercleanse | Members – Membership & User Role Editor Plugin | up to 3.2.22 | — | No fix listed | CNA |
- Members – Membership & User Role Editor Plugin Vendorsupercleanse Affected up to 3.2.22 Fixed in — No fix listed CNA
Remediation
No fixed version listed by the sources yet.
Timeline
- 2026-10-02 Threatist record created from CVE-2026-12426
- 2026-10-03 Alias added: GHSA-5xr4-65q6-7jp8
References
Other 6
- https://www.wordfence.com/threat-intel/vulnerabilities/id/9c3557a6-aa72-496c-8515-2f6055de6b22?source=cve
- https://plugins.trac.wordpress.org/browser/members/tags/3.2.22/inc/functions-content-permissions.php#L337
- https://plugins.trac.wordpress.org/browser/members/tags/3.2.22/inc/functions-private-site.php#L42
- https://plugins.trac.wordpress.org/browser/members/tags/3.2.19/inc/functions-content-permissions.php#L337
- https://plugins.trac.wordpress.org/browser/members/tags/3.2.19/inc/functions-private-site.php#L42
- https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&new=3594293%40members%2Ftrunk&old=3552545%40members%2Ftrunk&sfp_email=&sfph_mail=
More supercleanse vulnerabilities
- TI-2026-83498 Stored cross-site scripting in ThirstyAffiliates plugin for WordPress CVSS 3.1HIGH 7.2
- TI-2024-10199 Members <= 3.2.10 - Unauthenticated Content Restriction Bypass to Sensitive Information Exposure CVSS 3.1MEDIUM 5.3
- TI-2026-01011 Buy Now Plus <= 1.0.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode Attributes CVSS 3.1MEDIUM 6.4
- TI-2026-04417 PrettyLinks <= 3.6.20 - Authenticated (Administrator+) SQL Injection via 's' Parameter CVSS 3.1MEDIUM 4.9
Sources
- CVE-2026-12426 · CVE Program
- CVE-2026-12426 · NVD
- FIRST EPSS
- GHSA-5xr4-65q6-7jp8 · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences