CVE-2026-112355: MembershipWorks WordPress Plugin < 6.17 Information Disclosure via WordPress REST API
The MembershipWorks plugin for WordPress before 6.17 contains an information disclosure vulnerability that allows unauthenticated attackers to access member-only content through the WordPress REST API. Because the filter that strips protected content for non-members is only attached during normal front-end request handling and not during REST API requests, an unauthenticated attacker can retrieve the raw member-only content in a post or page’s rendered content, bypassing the plugin’s content protection.
Affected Software
Event History
Frequently Asked Questions
Who can exploit this issue?
Any unauthenticated remote attacker who can query the affected WordPress site's REST API can retrieve member-only content exposed in rendered posts or pages. No account, user interaction, or special privileges are required.
Which content is at risk?
Member-only content contained in WordPress posts or pages is at risk when it is protected by the plugin's content-filtering mechanism. The REST API may return the raw rendered content without the protection filter being applied.
Are default deployments affected?
The issue affects MembershipWorks plugin versions before 6.17 when member-only content is served through the WordPress REST API. The provided information does not identify any additional configuration requirement.
What should be done if an update cannot be applied immediately?
Restrict unauthenticated access to the WordPress REST API or to REST API endpoints that expose post and page content until the plugin can be updated. This reduces the path used to retrieve unfiltered member-only content.