Cpe:2.3:a:membershipworks:membershipworks:*:*:*:*:*:wordpress:*:* - CraftedSignal Threat Feedhttps://feed.craftedsignal.io/cpes/cpe2.3amembershipworksmembershipworkswordpress/Trending threats, MITRE ATT&CK coverage, and detection metadata. Fed continuously.Hugoenhello@craftedsignal.iohello@craftedsignal.ioTue, 27 Oct 2026 22:06:40 +0000https://feed.craftedsignal.io/favicon-32x32.pngCraftedSignal Threat Feedhttps://feed.craftedsignal.io/3232https://feed.craftedsignal.io/favicon.svgMembershipWorks WordPress Plugin: Information Disclosure (CVE-2026-112355)https://feed.craftedsignal.io/briefs/2026-10-membershipworks-info-disclosure/Tue, 27 Oct 2026 22:06:40 +0000hello@craftedsignal.iohttps://feed.craftedsignal.io/briefs/2026-10-membershipworks-info-disclosure/The MembershipWorks WordPress plugin prior to version 6.17 fails to enforce content protection filters on WordPress REST API requests, allowing unauthenticated attackers to retrieve restricted member-only content.The MembershipWorks WordPress plugin (versions prior to 6.17) contains an information disclosure vulnerability (CVE-2026-112355). The vulnerability exists because the plugin's access control logic - which restricts sensitive content - is only applied during standard front-end page rendering. It is not attached to the WordPress REST API, allowing unauthorized users to retrieve protected content by querying the REST API endpoint directly.

Impact

Unauthenticated remote attackers can bypass content restrictions and access private data intended exclusively for registered members. No exploit code or evidence of in-the-wild exploitation is currently documented.

Recommendation

  • Update the MembershipWorks plugin to version 6.17 or later immediately.
  • Review WordPress access logs for anomalous REST API traffic targeting post or page content if the plugin was previously exposed to public internet traffic.
]]>highthreatwordpressvulnerabilityinformation-disclosurerest-api