Vulnerability · Published Oct 27, 2026 · Assigned by VulnCheck

CVE-2026-112355MembershipWorks WordPress Plugin < 6.17 Information Disclosure via WordPress REST API

High 7.5

In plain English

A high-severity missing authorization in MembershipWorks from MembershipWorks. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.3% (higher than 19% of all known vulnerabilities).

Severity (CVSS 3.1)7.5High

Exploit odds (30 days)0.3%top 80.9% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

The MembershipWorks plugin for WordPress before 6.17 contains an information disclosure vulnerability that allows unauthenticated attackers to access member-only content through the WordPress REST API. Because the filter that strips protected content for non-members is only attached during normal front-end request handling and not during REST API requests, an unauthenticated attacker can retrieve the raw member-only content in a post or page’s rendered content, bypassing the plugin’s content protection.

Affected products (as reported)

Vendor	Product	Versions
MembershipWorks	MembershipWorks	0 – before 6.17

Weakness: CWE-862 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

References

WordPress Plugin Changelog release-notes, patch
VulnCheck Advisory: MembershipWorks WordPress Plugin < 6.17 Information Disclosure via WordPress REST API third-party-advisory