Security Advisory

CVE-2026-12426

CVE vulnerability detail - eXtreme Datacenter Security Operations

Published 2026-07-11 02:31:18

Last updated 2026-07-14 14:18:17

Assigner Wordfence

CVSS score 5.3

State PUBLISHED

Description

The Members – Membership & User Role Editor Plugin plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 3.2.22 via the members_filter_protected_posts_for_rest. This makes it possible for unauthenticated attackers to extract determine the existence and exact count of access-restricted posts, and use per-page pagination as a boolean oracle to infer keywords and content contained within those hidden restricted posts.

← Browse all CVEs View on cve.org ↗