CVE-2026-114452 · Package
NO FIX YET · SEE WHAT TO DO
The Membership Plugin for WordPress before 4.0.6 does not check that a saved-card payment request belongs to the requesting user. A subscriber-level member can obtain another member's Stripe payment client secret and attach their own payment method to that member's pending payment.
first public Nov 15, 2026 · 1 source
Check it with your coding agent
It reads this page and tells you if your code or app is affected.
Sites running the Membership Plugin for WordPress before 4.0.6 that accept saved-card payments through Stripe and have subscriber-level member accounts. The sources do not say whether the flaw depends on specific settings beyond the saved-card payment flow.
Not affected if plugin-version-4.0.6-or-later
Who cares membership-plugin, stripe, wordpress
4.0.6 or later.The Membership Plugin WordPress plugin before 4.0.6 does not verify that the membership referenced in a saved-card payment request belongs to the user making it, allowing subscriber-level members to disclose another member's Stripe payment client secret and attach a payment method of their choosing to another member's pending payment.
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.
Are you affected?
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.
InfraStack checks it against your stack and answers on your report, with the evidence and the fix.