HIGH 8.7 NVD
CVE-2026-112355
The MembershipWorks plugin for WordPress before 6.17 contains an information disclosure vulnerability that allows unauthenticated attackers to access member-onl
The MembershipWorks plugin for WordPress before 6.17 contains an information disclosure vulnerability that allows unauthenticated attackers to access member-only content through the WordPress REST API. Because the filter that strips protected content for non-members is only attached during normal front-end request handling and not during REST API requests, an unauthenticated attacker can retrieve the raw member-only content in a post or page’s rendered content, bypassing the plugin’s content protection.
References
- https://wordpress.org/plugins/memberfindme/#developers
- https://www.vulncheck.com/advisories/membershipworks-wordpress-plugin-information-disclosu
This high severity vulnerability with a CVSS score of 8.7 was published on 2026-10-27 via NVD.
vulnfeed aggregates 18943 vulnerabilities from NVD, CISA KEV,
Ubuntu, Debian, Red Hat, Kubernetes, Exploit-DB, OSS-Security, GitHub and OpenStack — updated every 4 hours.