MembershipWorks WordPress Plugin: Information Disclosure (CVE-2026-112355)
The MembershipWorks WordPress plugin prior to version 6.17 fails to enforce content protection filters on WordPress REST API requests, allowing unauthenticated attackers to retrieve restricted member-only content.
CVE search metadata
CVE search record: CVE-2026-112355. Severity: high. CVSS: 7.5. KEV: no. Product: MembershipWorks (< 6.17). Brief: MembershipWorks WordPress Plugin: Information Disclosure (CVE-2026-112355). Brief link: https://feed.craftedsignal.io/briefs/2026-10-membershipworks-info-disclosure/
Triage facts
Revision 1- Applicability
- MembershipWorks (< 6.17)
- Evidence
- Unknown
- Severity
- High
- Action
- Elevated
- Sources
- 1 public source
- Freshness
- Revision 1Oct 27, 22:06 UTC
- Vulnerabilities
- 1 CVE
- Source quality
- A2Roughly even chance
The MembershipWorks WordPress plugin (versions prior to 6.17) contains an information disclosure vulnerability (CVE-2026-112355). The vulnerability exists because the plugin's access control logic - which restricts sensitive content - is only applied during standard front-end page rendering. It is not attached to the WordPress REST API, allowing unauthorized users to retrieve protected content by querying the REST API endpoint directly.
Impact
Unauthenticated remote attackers can bypass content restrictions and access private data intended exclusively for registered members. No exploit code or evidence of in-the-wild exploitation is currently documented.
Recommendation
- Update the MembershipWorks plugin to version 6.17 or later immediately.
- Review WordPress access logs for anomalous REST API traffic targeting post or page content if the plugin was previously exposed to public internet traffic.
Immediate actions
Upgrade the MembershipWorks plugin to version 6.17 or later across all WordPress instances.
Threat Hunt
Monitor WordPress access logs for high-volume or repeated REST API requests originating from unauthorized IP addresses, specifically targeting endpoints that return page or post content.
Data: WordPress web server access logs (e.g., cs-uri-stem containing /wp-json/wp/v2/posts or /wp-json/wp/v2/pages)
Mitigations
Upgrade to MembershipWorks 6.17 or later
CVE-2026-112355