MembershipWorks WordPress plugin: Information disclosure via REST API
Summary
The MembershipWorks plugin for WordPress before version 6.17 does not apply its content filter to WordPress REST API requests. An unauthenticated attacker can therefore read the raw content of member-only posts and pages, bypassing the paywall. The attack requires no account and no user interaction, and the vulnerability affects confidentiality only.
Affected
- MembershipWorks plugin for WordPress (slug memberfindme), all versions before 6.17
- Some sources state up to 6.16, which is consistent with the same boundary
Fixed in
- Version 6.17 (WordPress.org changelog: fixes unauthenticated disclosure of member-only content via the REST API)
Workaround
- No vendor-published workaround is known.
- If patching is delayed, review which posts and pages contain member-only content and ask the vendor whether REST API exposure can be restricted. Test any restriction first, as it may break other plugins and the block editor.
Exploitation
- Not known to be exploited in the wild.
- No public proof-of-concept exploit found; this does not prove that none exists.
- Reported privately by buiih via VulnCheck and then published.
Our recommendation
- Update the MembershipWorks plugin to version 6.17 or later promptly, without waiting for a regular maintenance window.
- Check whether member-only content or personal data of members was published on the site before the update.
- Review web server and access logs for anonymous REST API requests against posts and pages, and treat protected content as potentially exposed if such requests are found.
- Check whether your WordPress site uses this plugin and is reachable from the internet.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- WordPress.org plugin page (memberfindme) wordpress.org
- VulnCheck advisory www.vulncheck.com
- VulDB entry 427549 vuldb.com
- OffSeq threat radar entry radar.offseq.com
- CVE aggregator record (threatint) cve.threatint.com
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 31 Oct 2026, 23:51.
Original description (NVD)
The MembershipWorks plugin for WordPress before 6.17 contains an information disclosure vulnerability that allows unauthenticated attackers to access member-only content through the WordPress REST API. Because the filter that strips protected content for non-members is only attached during normal front-end request handling and not during REST API requests, an unauthenticated attacker can retrieve the raw member-only content in a post or page’s rendered content, bypassing the plugin’s content protection.
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.