PT-2026-57375 · Supercleanse · Members – Membership & User Role Editor Plugin

Huazu Jiang · Publicado 2026-07-11 · Atualizado 2026-07-11 · CVE-2026-12426

NVD

CVSS v3.1

5.3

Média

Vetor base

AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

The Members – Membership & User Role Editor Plugin plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 3.2.22 via the members filter protected posts for rest. This makes it possible for unauthenticated attackers to extract determine the existence and exact count of access-restricted posts, and use per-page pagination as a boolean oracle to infer keywords and content contained within those hidden restricted posts.

Correção

Information Disclosure

Enumeração de Fraquezas

CWE-200

Identificadores relacionados

CVE-2026-12426

Produtos afetados

Members – Membership & User Role Editor Plugin

Referências · 7

• https://plugins.trac.wordpress.org/browser/members/tags/3.2.22/inc/functions-content-permissions.php#L337 · Nota
• https://plugins.trac.wordpress.org/browser/members/tags/3.2.19/inc/functions-private-site.php#L42 · Nota
• https://wordfence.com/threat-intel/vulnerabilities/id/9c3557a6-aa72-496c-8515-2f6055de6b22?source=cve · Nota
• https://plugins.trac.wordpress.org/browser/members/tags/3.2.22/inc/functions-private-site.php#L42 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2026-12426 · Nota de Segurança
• https://plugins.trac.wordpress.org/browser/members/tags/3.2.19/inc/functions-content-permissions.php#L337 · Nota
• https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&new=3594293%40members%2Ftrunk&old=3552545%40members%2Ftrunk&sfp_email=&sfph_mail= · Nota