{"id":"CVE-2026-114451","kind":"vulnerability","aliases":["CVE-2026-114451"],"related":[],"title":"Membership Plugin for WordPress: unauthenticated users can corrupt stored membership data","description":"The Membership Plugin  WordPress plugin before 4.0.6 does not perform any authorization or CSRF check before running a schema-altering database maintenance routine, allowing unauthenticated users to convert the Membership Plugin  WordPress plugin before 4.0.6's own tables to a narrower character set, which irreversibly replaces every 4-byte character (such as emoji and some CJK characters) in the membership level, discount code and payment records with a question mark.","summary":"The Membership Plugin for WordPress before 4.0.6 runs a database maintenance routine without any authorization or CSRF check. An unauthenticated visitor can trigger it to convert the plugin's tables to a narrower character set, irreversibly replacing 4-byte characters such as emoji in membership, discount code and payment records with question marks.","severity":"medium","cvss":null,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["membership-plugin","package","self-hosted","wordpress"],"not_affected_if":["plugin-not-installed","version-4.0.6-or-later"],"how_to_check":"- Check the installed Membership Plugin version in the WordPress admin plugins list or the plugin's main file header; unknown whether a specific version string is listed in the sources beyond 'before 4.0.6'.\n- Confirm whether the plugin is active on the site.","fix":"- Membership Plugin for WordPress: move to `4.0.6` or later (the sources state the plugin is fixed in versions from 4.0.6).","status":"open","published_at":"2026-11-15T07:16:53+00:00","first_seen_at":"2026-11-15T07:36:11+00:00","triaged_at":"2026-11-15T07:36:22+00:00","updated_at":"2026-11-15T07:36:22+00:00","category":"package","confidence":0.7,"triage":{"at":"2026-11-15T07:36:22Z","model":"claude-haiku-5-5","output":{"fix":"- Membership Plugin for WordPress: move to `4.0.6` or later (the sources state the plugin is fixed in versions from 4.0.6).","reach":"internet","title":"Membership Plugin for WordPress: unauthenticated users can corrupt stored membership data","impact":"medium","summary":"The Membership Plugin for WordPress before 4.0.6 runs a database maintenance routine without any authorization or CSRF check. An unauthenticated visitor can trigger it to convert the plugin's tables to a narrower character set, irreversibly replacing 4-byte characters such as emoji in membership, discount code and payment records with question marks.","audience":"businesses","category":"package","nicknames":[],"who_cares":["wordpress","membership-plugin","self-hosted"],"confidence":0.7,"fix_status":"available","needs_auth":"no","worst_case":"Unauthenticated users corrupt membership, discount and payment records irreversibly","analyst_note":"Confirm the fixed version and whether the plugin's vendor advisory names one; check how the maintenance routine is exposed on the public site.","how_to_check":"- Check the installed Membership Plugin version in the WordPress admin plugins list or the plugin's main file header; unknown whether a specific version string is listed in the sources beyond 'before 4.0.6'.\n- Confirm whether the plugin is active on the site.","plain_action":"","product_name":"","needs_analyst":true,"not_affected_if":["plugin-not-installed","version-4.0.6-or-later"],"who_is_affected":"Sites running the Membership Plugin for WordPress below version 4.0.6 are exposed, because the vulnerable routine can be triggered by anyone without logging in. The damage is to stored membership, discount and payment records, so sites selling memberships are most affected. Sites without the plugin or already on 4.0.6 or later can skip it.","user_interaction":"no","product_ecosystem":"","needs_special_setup":"unknown","severity_if_unknown":"medium"},"cost_usd":0.000806,"input_tokens":4599,"output_tokens":692,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'-114451':14A,17A '-2026':13A,16A '4':63B,127C '4.0.6':32B,85C,114C 'allow':103C 'alter':99C 'author':40B,90C 'byte':64B,128C 'charact':59B,65B,121C,129C,136C 'check':43B,93C 'cjk':135C 'code':72B,142C 'convert':51B,107C 'corrupt':8A 'csrf':42B,92C 'cve':12A,15A 'data':11A 'databas':35B,100C 'discount':71B,141C 'emoji':68B,132C 'everi':126C 'host':24B 'irrevers':61B,124C 'level':140C 'mainten':36B,101C 'mark':78B,149C 'membership':1A,10A,19B,27B,70B,80C,109C,139C 'membership-plugin':18B 'narrow':58B,120C 'packag':21B 'payment':74B,144C 'perform':88C 'plugin':2A,20B,28B,53B,81C,83C,110C,112C 'question':77B,148C 'record':75B,145C 'replac':62B,125C 'routin':37B,102C 'run':33B,95C 'schema':98C 'schema-alt':97C 'self':23B 'self-host':22B 'set':60B,122C 'store':9A 'tabl':55B,117C 'trigger':48B 'unauthent':5A,45B,104C 'user':6A,105C 'visitor':46B 'without':38B 'wordpress':4A,25B,30B,82C,111C","nicknames":[],"mitigations":[],"who_affected":"Sites running the Membership Plugin for WordPress below version 4.0.6 are exposed, because the vulnerable routine can be triggered by anyone without logging in. The damage is to stored membership, discount and payment records, so sites selling memberships are most affected. Sites without the plugin or already on 4.0.6 or later can skip it.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["medium","membershipplugin","package","selfhosted","wordpress"],"campaign_type":null,"search_a":"'-114451':14A,17A '-2026':13A,16A 'corrupt':8A 'cve':12A,15A 'data':11A 'membership':1A,10A 'plugin':2A 'store':9A 'unauthent':5A 'user':6A 'wordpress':4A","search_b":"'4':63B '4.0.6':32B 'author':40B 'byte':64B 'charact':59B,65B 'check':43B 'code':72B 'convert':51B 'csrf':42B 'databas':35B 'discount':71B 'emoji':68B 'host':24B 'irrevers':61B 'mainten':36B 'mark':78B 'membership':19B,27B,70B 'membership-plugin':18B 'narrow':58B 'packag':21B 'payment':74B 'plugin':20B,28B,53B 'question':77B 'record':75B 'replac':62B 'routin':37B 'run':33B 'self':23B 'self-host':22B 'set':60B 'tabl':55B 'trigger':48B 'unauthent':45B 'visitor':46B 'without':38B 'wordpress':25B,30B","search_c":"'4':127C '4.0.6':85C,114C 'allow':103C 'alter':99C 'author':90C 'byte':128C 'charact':121C,129C,136C 'check':93C 'cjk':135C 'code':142C 'convert':107C 'csrf':92C 'databas':100C 'discount':141C 'emoji':132C 'everi':126C 'irrevers':124C 'level':140C 'mainten':101C 'mark':149C 'membership':80C,109C,139C 'narrow':120C 'payment':144C 'perform':88C 'plugin':81C,83C,110C,112C 'question':148C 'record':145C 'replac':125C 'routin':102C 'run':95C 'schema':98C 'schema-alt':97C 'set':122C 'tabl':117C 'unauthent':104C 'user':105C 'wordpress':82C,111C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-15T07:16:53+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-114451","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-114451","severity":null,"published_at":"2026-11-15T07:16:53+00:00","modified_at":"2026-11-15T07:16:53+00:00","first_seen_at":"2026-11-15T07:36:11+00:00","fetched_at":"2026-11-15T07:36:11+00:00","note":null}],"documents":[],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}