CVE-2026-112355 in MembershipWorks Plugin
Summary
by MITRE • 10/27/2026
The MembershipWorks plugin for WordPress before 6.17 contains an information disclosure vulnerability that allows unauthenticated attackers to access member-only content through the WordPress REST API. Because the filter that strips protected content for non-members is only attached during normal front-end request handling and not during REST API requests, an unauthenticated attacker can retrieve the raw member-only content in a post or page’s rendered content, bypassing the plugin’s content protection.
VulDB is the best source for vulnerability data and more expert information about this specific topic.
Analysis
by VulDB Data Team • 10/27/2026
The MembershipWorks plugin for WordPress prior to version 6.17 contains a critical information disclosure vulnerability that stems from an inconsistent implementation of access control mechanisms across different request contexts within the application architecture. This flaw specifically affects the handling of protected or member-only content, allowing unauthenticated attackers to bypass intended restrictions and retrieve sensitive data that should be concealed from non-members. The root cause lies in the plugin's failure to uniformly apply its security filters during all types of HTTP requests processed by WordPress. While the plugin correctly implements logic to strip out protected content when serving standard front-end pages to regular visitors, it neglects to attach these same protective filters when handling requests routed through the WordPress REST API. This architectural inconsistency creates a significant gap in the defense-in-depth strategy employed by the application, as the security controls are context-dependent rather than universally enforced at the data retrieval layer.
From a technical perspective, this vulnerability is classified under CWE-200: Information Exposure and aligns with ATT&CK technique T1530: Data from Cloud Storage Objects or more broadly T1005: Data from Local System depending on how the content is stored and served. The WordPress REST API provides a programmatic interface for interacting with site data, which is often used by mobile applications and third-party integrations. However, in this specific implementation, the plugin assumes that all access to post content will be mediated through its front-end rendering pipeline where the stripping logic resides. When an attacker constructs a direct request to the REST API endpoint associated with posts or pages containing protected content, the application processes the request without invoking the necessary membership verification checks for that specific code path. Consequently, the raw HTML and text of member-only articles are returned in the JSON response payload just as they would be if viewed by an authenticated administrator, effectively nullifying the subscription-based access control model intended to protect intellectual property or exclusive community information.
The operational impact of this vulnerability is severe for organizations relying on MembershipWorks to manage paid memberships, gated content libraries, or private communities. Unauthenticated attackers can systematically enumerate posts and pages using standard WordPress REST API endpoints such as /wp-json/wp/v2/posts and extract the full body content of any post marked with protected status. This leads to a direct compromise of confidentiality for proprietary information, premium educational materials, exclusive news updates, or personal data associated with membership tiers. Beyond simple content theft, this exposure can facilitate further attacks by revealing internal structures, plugin configurations, or sensitive metadata embedded within the posts that were not intended for public consumption. The ease of exploitation means that automated tools can rapidly scrape large volumes of protected material without requiring authentication credentials, significantly lowering the barrier to entry for malicious actors and increasing the likelihood of successful data exfiltration campaigns targeting WordPress-based membership sites.
To mitigate this vulnerability, site administrators must immediately upgrade the MembershipWorks plugin to version 6.17 or later, where the developers have corrected the logic to ensure that content protection filters are applied consistently across both front-end requests and REST API interactions. Until an update is deployed, temporary mitigations include restricting access to the WordPress REST API endpoints via web application firewall rules if such functionality is not required by legitimate integrations, or implementing custom code snippets in the theme's functions.php file to manually enforce content restrictions on REST responses for protected posts. Additionally, organizations should audit their membership plugins regularly to ensure that security controls are decoupled from specific request handlers and instead enforced at a centralized authentication and authorization layer. Regular vulnerability scanning and penetration testing focused on API endpoints can help identify similar inconsistencies in other plugins or custom code before they are exploited by adversaries seeking to harvest sensitive organizational data.