CVE-2026-112355MembershipWorks WordPress Plugin < 6.17 Information Disclosure via WordPress REST API

Açıklama

The MembershipWorks plugin for WordPress before 6.17 contains an information disclosure vulnerability that allows unauthenticated attackers to access member-only content through the WordPress REST API. Because the filter that strips protected content for non-members is only attached during normal front-end request handling and not during REST API requests, an unauthenticated attacker can retrieve the raw member-only content in a post or page’s rendered content, bypassing the plugin’s content protection.

Veri: CVE.org, NVD, CISA KEV, FIRST EPSS, Ubuntu. Bilgiler kaynaktaki haliyle, İngilizce yayımlanır.

Etkilenen ürünler ve sürümler

Kaynaklar ve yamalar

• WordPress Plugin Changelog release-notespatch
• VulnCheck Advisory: MembershipWorks WordPress Plugin < 6.17 Information Disclosure via WordPress REST API third-party-advisory