CVE-2026-112355
CVE-2026-112355 · MembershipWorks WordPress Plugin < 6.17 Information Disclosure via WordPress REST API
Cette page présente des faits issus de sources publiques. Consultez l’avis original avant toute mise à jour.
The MembershipWorks plugin for WordPress before 6.17 contains an information disclosure vulnerability that allows unauthenticated attackers to access member-only content through the WordPress REST API. Because the filter that strips protected content for non-members is only attached during normal front-end request handling and not during REST API requests, an unauthenticated attacker can retrieve the raw member-only content in a post or page’s rendered content, bypassing the plugin’s content protection.
CVSS 8.7 · Élevée · EPSS 0,3% · Correctif disponible
- Publication
- Mise à jour
Produits et versions concernés
membershipworks
- Versions du logiciel
- ≥ 0, < 6.17: Concernée (custom)
Mettez à jour vers 6.17