Skip to content
CVE-2026-112355: MembershipWorks Plugin Exposes Member Content

CVE-2026-112355: MembershipWorks Plugin Exposes Member Content

First seen 28 Oct 2026, 17:10 UTC • •
API

Article Content

Browse articles
ThreatCluster AI
ThreatCluster •October 28, 2026 at 18:11 UTC
  • •CVE-2026-112355 affects MembershipWorks plugin versions < 6.17.
  • •Unauthenticated attackers can access protected content via the REST API.
  • •No active exploitation reported; patch recommended for affected sites.

The MembershipWorks plugin for WordPress versions prior to 6.17 has an information disclosure vulnerability (CVE-2026-112355) that allows unauthenticated attackers to access member-only content via the WordPress REST API. This flaw arises because the content protection filter is not applied to REST API requests, enabling attackers to retrieve sensitive information without authentication. The risk is particularly high for sites using this plugin to protect gated content, as it could lead to unauthorized access to personal or commercial data. Currently, there are no reports of active exploitation or widespread attacks. Administrators are advised to upgrade to version 6.17 or restrict public access to the REST API until a patch is applied. The CVSS score for this vulnerability is 8.7, indicating a high severity level. The vulnerability was published on October 27, 2026.

Start a free Starter trial for enhanced analysis

Ask AI about this cluster

Updated just now How this analysis works

Timeline

2026-10-27
CVE-2026-112355 published
The vulnerability was officially published, detailing the information disclosure risk in MembershipWorks plugin versions prior to 6.17.
Redpacketsecurity
2026-10-28
Vulnerability disclosed by multiple outlets
Multiple cybersecurity outlets reported on the vulnerability, highlighting its potential impact and recommended mitigations.
www.vulncheck.com

More articles in this cluster (3)

Following this threat?

Track CVE-2026-112355 in your own feed — you're alerted when they show up in new reporting, leak sites or exploitation.

Free account · no card needed

Extracted Entities (4)

1 / 3

Common questions

Which versions are affected?
The vulnerability affects all versions of the MembershipWorks plugin for WordPress prior to 6.17.
Is there a patch available?
Yes, users are advised to upgrade to MembershipWorks version 6.17 to mitigate the vulnerability.
What should I do if I cannot upgrade immediately?
Restrict public access to the REST API for protected content until you can apply the patch.