{"id":"CVE-2026-112355","kind":"vulnerability","aliases":["CVE-2026-112355"],"related":[],"title":"MembershipWorks WordPress plugin leaks member-only content via REST API","description":"The MembershipWorks plugin for WordPress before 6.17 contains an information disclosure vulnerability that allows unauthenticated attackers to access member-only content through the WordPress REST API. Because the filter that strips protected content for non-members is only attached during normal front-end request handling and not during REST API requests, an unauthenticated attacker can retrieve the raw member-only content in a post or page’s rendered content, bypassing the plugin’s content protection.","summary":"The MembershipWorks plugin for WordPress before 6.17 hides member-only content on normal page loads but not through the WordPress REST API. An unauthenticated attacker can read the raw protected content of any post or page through that API.","severity":"high","cvss":8.7,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["membershipworks","package","self-hosted","wordpress"],"not_affected_if":["default-config"],"how_to_check":"- Check the installed MembershipWorks plugin version in the WordPress admin plugins list or in `wp-content/plugins/` and confirm whether it is below `6.17`.\n- Request a protected post through the REST API without logging in, for example `curl https://example.com/wp-json/wp/v2/posts/<id>`, and see whether the member-only text appears in the rendered content.","fix":"- Update the MembershipWorks plugin to `6.17` or later.\n- Until the update is applied, review member-only pages and assume their content may have been read.","status":"open","published_at":"2026-10-27T20:17:13+00:00","first_seen_at":"2026-10-27T20:33:27+00:00","triaged_at":"2026-10-27T20:35:25+00:00","updated_at":"2026-10-27T20:35:25+00:00","category":"package","confidence":0.7,"triage":{"at":"2026-10-27T20:35:25Z","model":"claude-haiku-5-5","output":{"fix":"- Update the MembershipWorks plugin to `6.17` or later.\n- Until the update is applied, review member-only pages and assume their content may have been read.","reach":"internet","title":"MembershipWorks WordPress plugin leaks member-only content via REST API","impact":"medium","summary":"The MembershipWorks plugin for WordPress before 6.17 hides member-only content on normal page loads but not through the WordPress REST API. An unauthenticated attacker can read the raw protected content of any post or page through that API.","category":"package","nicknames":[],"who_cares":["wordpress","membershipworks","self-hosted"],"confidence":0.7,"needs_auth":"no","worst_case":"Anyone can read member-only post and page content without logging in","analyst_note":"","how_to_check":"- Check the installed MembershipWorks plugin version in the WordPress admin plugins list or in `wp-content/plugins/` and confirm whether it is below `6.17`.\n- Request a protected post through the REST API without logging in, for example `curl https://example.com/wp-json/wp/v2/posts/<id>`, and see whether the member-only text appears in the rendered content.","needs_analyst":false,"not_affected_if":["default-config"],"who_is_affected":"Sites that run the MembershipWorks plugin below version 6.17 and keep member-only content in posts or pages are exposed, because the REST API returns the unfiltered rendered content to anyone. Sites that do not use MembershipWorks, or that have it at 6.17 or later, are not affected by this flaw.","user_interaction":"no","needs_special_setup":"no","severity_if_unknown":"high"},"cost_usd":0.00062,"input_tokens":3366,"output_tokens":566,"severity_before":"high"},"analyst_status":null,"analyst_note":null,"search":"'-112355':14A,17A '-2026':13A,16A '6.17':30B,70C 'access':81C 'allow':77C 'api':11A,46B,63B,90C,116C 'attach':104C 'attack':49B,79C,120C 'bypass':137C 'contain':71C 'content':8A,35B,55B,85C,97C,128C,136C,141C 'cve':12A,15A 'disclosur':74C 'end':109C 'filter':93C 'front':108C 'front-end':107C 'handl':111C 'hide':31B 'host':22B 'inform':73C 'leak':4A 'load':39B 'member':6A,33B,83C,101C,126C 'member-on':5A,32B,82C,125C 'membershipwork':1A,18B,25B,65C 'non':100C 'non-memb':99C 'normal':37B,106C 'packag':19B 'page':38B,60B,133C 'plugin':3A,26B,66C,139C 'post':58B,131C 'protect':54B,96C,142C 'raw':53B,124C 'read':51B 'render':135C 'request':110C,117C 'rest':10A,45B,89C,115C 'retriev':122C 'self':21B 'self-host':20B 'strip':95C 'unauthent':48B,78C,119C 'via':9A 'vulner':75C 'wordpress':2A,23B,28B,44B,68C,88C","nicknames":[],"mitigations":[],"who_affected":"Sites that run the MembershipWorks plugin below version 6.17 and keep member-only content in posts or pages are exposed, because the REST API returns the unfiltered rendered content to anyone. Sites that do not use MembershipWorks, or that have it at 6.17 or later, are not affected by this flaw.","tier":"B","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-27T20:17:13+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"disclosure@vulncheck.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-112355","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-112355","severity":null,"published_at":"2026-10-27T20:17:13+00:00","modified_at":"2026-10-27T20:17:13+00:00","first_seen_at":"2026-10-27T20:33:27+00:00","fetched_at":"2026-10-27T20:33:27+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}