Live › vulnerability › CVE-2026-112355
Go to dashboardThe MembershipWorks plugin for WordPress before 6.17 hides member-only content on normal page loads but not through the WordPress REST API. An unauthenticated attacker can read the raw protected content of any post or page through that API.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-27 20:33 UTC. All times on this page are UTC.
Sites that run the MembershipWorks plugin below version 6.17 and keep member-only content in posts or pages are exposed, because the REST API returns the unfiltered rendered content to anyone. Sites that do not use MembershipWorks, or that have it at 6.17 or later, are not affected by this flaw.
No product ranges from the sources yet.
wp-content/plugins/ and confirm whether it is below 6.17.curl https://example.com/wp-json/wp/v2/posts/<id>, and see whether the member-only text appears in the rendered content.6.17 or later.Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
The MembershipWorks plugin for WordPress before 6.17 contains an information disclosure vulnerability that allows unauthenticated attackers to access member-only content through the WordPress REST API. Because the filter that strips protected content for non-members is only attached during normal front-end request handling and not during REST API requests, an unauthenticated attacker can retrieve the raw member-only content in a post or page’s rendered content, bypassing the plugin’s content protection.
This page as .md · .json · in your agent: get_signal("CVE-2026-112355")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.