Information disclosure in MembershipWorks WordPress plugin via REST API
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- None
- Attack complexity
- Low
- Attack requirements
- None
- Impact type
- Security bypass
- Confidentiality · integrity · availability
- High · None · None
- Fix status
- Fixed
Attack profile from CVSS 4.0 · CNA. Fix status from CNA. Impact type from CWE-862.
Summary
The MembershipWorks plugin for WordPress before 6.17 contains an information disclosure flaw (CWE-862) in which the filter that hides member-only content from non-members is not applied during WordPress REST API requests. An unauthenticated remote attacker can retrieve the raw member-only content of a post or page through the REST API, bypassing the plugin's content protection.
Written with Claude Haiku 5.5 from the sources below · 2026-11-04
Description from the CNA
The MembershipWorks plugin for WordPress before 6.17 contains an information disclosure vulnerability that allows unauthenticated attackers to access member-only content through the WordPress REST API. Because the filter that strips protected content for non-members is only attached during normal front-end request handling and not during REST API requests, an unauthenticated attacker can retrieve the raw member-only content in a post or page’s rendered content, bypassing the plugin’s content protection.
Why it matters now
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- Yes
- Technical impact
- Partial
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| MembershipWorks | MembershipWorks | before 6.17 | 6.17 | Patch available | CNA |
- MembershipWorks VendorMembershipWorks Affected before 6.17 Fixed in 6.17 Patch available CNA
Remediation
MembershipWorks plugin version 6.17 fixes this issue, so update from any version before 6.17.
Written with Claude Haiku 5.5 from the sources below · 2026-11-04
- Fix · CNA MembershipWorks (MembershipWorks) Fixed in 6.17
Timeline
- 2026-10-27 Threatist record created from CVE-2026-112355
- 2026-10-27 Alias added: GHSA-hvvh-f79h-xxpp
- 2026-10-28 Priority changed: MEDIUM → LOW
- 2026-11-04 CISA SSVC decision points changed
- 2026-11-04 Priority changed: LOW → MEDIUM
References
Patch 1
Sources
- CVE-2026-112355 · CVE Program
- CVE-2026-112355 · NVD
- FIRST EPSS
- GHSA-hvvh-f79h-xxpp · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences