CVE-2026-19709: Membership For WooCommerce < 3.1.2 - Unauthenticated Member Data Disclosure via REST Consumer Secret Bypass
The Membership For WooCommerce WordPress plugin before 3.1.2 does not check that an API consumer secret has actually been generated before comparing it against the one supplied in a request, allowing unauthenticated attackers to reach its REST routes and disclose any user's membership plan details on sites where the API has been enabled but no keys were ever generated.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
wordpress/plugin/membership-for-woocommerceto a version that resolves this vulnerability.Fixed in 3.1.2 - Compensating control
If the Membership For WooCommerce REST API has been enabled but no consumer secret keys were generated, restrict/disable access to the plugin’s REST routes until valid API consumer secrets are generated.
Event History
Frequently Asked Questions
Which sites are exposed to this disclosure?
Sites using Membership For WooCommerce versions before 3.1.2 are exposed when the plugin API is enabled and API keys have never been generated. The issue affects the plugin's REST routes under those conditions.
What does an attacker need to exploit this issue?
No authentication is required. An attacker can bypass the REST consumer-secret check because the plugin does not verify that a consumer secret exists before comparing it with the supplied value.
What information can be disclosed?
An attacker can disclose membership plan details for any user.