The MembershipWorks plugin for WordPress contains an information disclosure flaw that allows an unauthenticated attacker to fetch member‑only content through the WordPress REST API. Because the filter that removes protected content is only applied to standard front‑end requests, REST API calls return the raw, protected rendering of posts or pages. This bypasses the plugin’s protection and exposes sensitive member content, a flaw rated with a CVSS score of 8.7.

Affected users are those who have installed MembershipWorks on their WordPress site with a version earlier than 6.17. The vulnerability exists in all releases below 6.17 of the MembershipWorks WordPress plugin and affects any site using the plugin's content protection features.

The flaw is exploitable without authentication via public REST API endpoints; an attacker can simply craft an API request to retrieve protected content. Although EPSS data is not available and the vulnerability is not listed in CISA’s KEV catalog, the high CVSS score indicates a strong potential for misuse, especially on sites with sensitive member data. The risk is compounded by the ease of access through standard REST API calls.