{"schema":"threatline.record/2","record":{"id":"CVE-2026-112355","aliases":[],"summary":"MembershipWorks WordPress Plugin < 6.17 Information Disclosure via WordPress REST API","details":"The MembershipWorks plugin for WordPress before 6.17 contains an information disclosure vulnerability that allows unauthenticated attackers to access member-only content through the WordPress REST API. Because the filter that strips protected content for non-members is only attached during normal front-end request handling and not during REST API requests, an unauthenticated attacker can retrieve the raw member-only content in a post or page’s rendered content, bypassing the plugin’s content protection.","categories":["Unclassified"],"product":"MembershipWorks","vendor":"MembershipWorks","ecosystem":null,"affected_ranges":[{"source":"CVE List","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-112355","source_modified_at":"2026-10-27T19:15:49.546Z","fetched_at":"2026-10-27T21:14:11.489891Z","product":"MembershipWorks","vendor":"MembershipWorks","versions":[{"status":"affected","version":"0","versionType":"custom","lessThan":"6.17"}],"defaultStatus":"unaffected"}],"fixed_versions":[{"source":"CVE List","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-112355","source_modified_at":"2026-10-27T19:15:49.546Z","fetched_at":"2026-10-27T21:14:11.489891Z","package":{"name":"MembershipWorks","ecosystem":null},"version":"6.17","basis":"first unaffected version stated in the CVE record"}],"cvss":8.7,"severity":"High","kev":{"listed":false},"epss":{"probability":null,"percentile":null,"score_date":null},"published_at":"2026-10-27T19:15:49.546Z","modified_at":"2026-10-27T19:15:49.546Z","provenance":[{"source":"CVE List","url":"https://www.cve.org/CVERecord?id=CVE-2026-112355","fetched_at":"2026-10-27T21:14:11.489891Z","source_modified_at":"2026-10-27T19:15:49.546Z"}],"sources":["CVE List"],"references":[{"source":"CVE List","url":"https://wordpress.org/plugins/memberfindme/#developers","tags":["release-notes","patch"]},{"source":"CVE List","url":"https://www.vulncheck.com/advisories/membershipworks-wordpress-plugin-information-disclosure-via-wordpress-rest-api","tags":["third-party-advisory"]}],"locations":[],"motoko_assessment":{"status":"requires_architecture_review","automatic_remediation":false},"cve_state":"PUBLISHED","cvss_source":"CVE List","classification":{"method":"product-first software-layer rules","rules_version":"2.1","matched_on":null,"confidence":"unknown","reviewed":false},"change_timestamp":"2026-10-27T19:15:49.546Z","content_hash":"fbb436dba1d1f898df684d396f12df71d93748bc464df953458d4e8f972d6ad3"}}