PT-2026-57375 · Supercleanse · Members – Membership & User Role Editor Plugin

Huazu Jiang · Published 2026-07-11 · Updated 2026-07-11 · CVE-2026-12426

NVD

CVSS v3.1

5.3

Medium

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

The Members – Membership & User Role Editor Plugin plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 3.2.22 via the members filter protected posts for rest. This makes it possible for unauthenticated attackers to extract determine the existence and exact count of access-restricted posts, and use per-page pagination as a boolean oracle to infer keywords and content contained within those hidden restricted posts.

Fix

Information Disclosure

Weakness Enumeration

CWE-200

Related Identifiers

CVE-2026-12426

Affected Products

Members – Membership & User Role Editor Plugin

References · 7

• https://nvd.nist.gov/vuln/detail/CVE-2026-12426 · Security Note
• https://plugins.trac.wordpress.org/browser/members/tags/3.2.22/inc/functions-content-permissions.php#L337 · Note
• https://plugins.trac.wordpress.org/browser/members/tags/3.2.19/inc/functions-private-site.php#L42 · Note
• https://wordfence.com/threat-intel/vulnerabilities/id/9c3557a6-aa72-496c-8515-2f6055de6b22?source=cve · Note
• https://plugins.trac.wordpress.org/browser/members/tags/3.2.22/inc/functions-private-site.php#L42 · Note
• https://plugins.trac.wordpress.org/browser/members/tags/3.2.19/inc/functions-content-permissions.php#L337 · Note
• https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&new=3594293%40members%2Ftrunk&old=3552545%40members%2Ftrunk&sfp_email=&sfph_mail= · Note