CVE-2025-14844: Membership Plugin – Restrict Content <= 3.2.16 - Missing Authentication to Insecure Direct Object Reference and Sensitive Information Exposure
The Membership Plugin – Restrict Content plugin for WordPress is vulnerable to Missing Authentication in all versions up to, and including, 3.2.16 via the 'rcpstripecreatesetupintentforsavedcard' function due to missing capability check. Additionally, the plugin does not check a user-controlled key, which makes it possible for unauthenticated attackers to leak Stripe SetupIntent clientsecret values for any membership.
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the severity of CVE-2025-14844?
CVE-2025-14844 is a high-severity vulnerability due to missing authentication leading to sensitive information exposure.
How do I fix CVE-2025-14844?
To fix CVE-2025-14844, update the Membership Plugin – Restrict Content to version 3.2.17 or later.
What types of attacks are possible due to CVE-2025-14844?
Due to CVE-2025-14844, attackers can exploit the vulnerability to access sensitive user information without proper authentication.
Which versions are affected by CVE-2025-14844?
CVE-2025-14844 affects all versions of the Membership Plugin – Restrict Content up to and including 3.2.16.
Is CVE-2025-14844 targeted at specific WordPress installations?
CVE-2025-14844 is a general vulnerability that can affect any WordPress installation using the vulnerable plugin version.