CVE-2026-12426

Members <= 3.2.22 - Unauthenticated Sensitive Information Disclosure via REST API Pagination Side Channel

View on CVE.org
Published Jul 11, 2026 CVSS 3.1 · 5.3 Medium EPSS < 1% KEV · Not listed
Description
The Members – Membership & User Role Editor Plugin plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 3.2.22 via the members_filter_protected_posts_for_rest. This makes it possible for unauthenticated attackers to extract determine the existence and exact count of access-restricted posts, and use per-page pagination as a boolean oracle to infer keywords and content contained within those hidden restricted posts.

Analysis

AI-generated

Technical impact

An unauthenticated attacker can exploit a side‑channel in the Members – Membership & User Role Editor Plugin’s REST API pagination to discover the existence and exact number of restricted posts. By repeatedly querying pages the attacker can determine which content is hidden and even infer keyword information about the protected posts. The flaw allows exposure of sensitive data that should remain private to authorized users.

Affected Systems

WordPress installations that use the Members – Membership & User Role Editor Plugin in versions up to and including 3.2.22 are impacted. The vulnerability arises from the members_filter_protected_posts_for_rest function in those releases.

Risk and Exploitability

The CVSS score of 5.3 indicates a moderate severity. The EPSS score of less than 1% reflect a low probability of exploitation at the time of assessment, and the vulnerability is not listed in the CISA KEV catalog. Attackers can gain the described information without authentication by sending normal REST API requests, making the attack surface readily accessible from the public internet.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Upgrade the Members plugin to the latest available version that contains the fix for this disclosure.
  • Disable or restrict unauthenticated access to the WordPress REST API endpoints that expose pagination information, using a web‑application firewall or access‑control policy.
  • Monitor REST API traffic for patterns indicative of pagination enumeration and investigate any anomalous activity.

Generated by OpenCVE AI on August 1, 2026 at 11:46 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories available
History
Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'yes', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}
Type Values Removed Values Added
First Time appeared Supercleanse
Supercleanse members – Membership & User Role Editor Plugin
Wordpress
Wordpress wordpress
Vendors & Products Supercleanse
Supercleanse members – Membership & User Role Editor Plugin
Wordpress
Wordpress wordpress
Type Values Removed Values Added
Description The Members – Membership & User Role Editor Plugin plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 3.2.22 via the members_filter_protected_posts_for_rest. This makes it possible for unauthenticated attackers to extract determine the existence and exact count of access-restricted posts, and use per-page pagination as a boolean oracle to infer keywords and content contained within those hidden restricted posts.
Title Members <= 3.2.22 - Unauthenticated Sensitive Information Disclosure via REST API Pagination Side Channel
Weaknesses CWE-200
References
Metrics cvssV3_1

{'score': 5.3, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N'}
Weaknesses
  • CWE-200

    Exposure of Sensitive Information to an Unauthorized Actor

Sources

Status
PUBLISHED
Assigner
Wordfence
Published
Updated
Jul 14, 2026, 2:18 PM
Reserved
Jun 16, 2026, 5:04 PM

View source JSON

Updated
Jul 14, 2026, 2:18 PM

JSON

Status
Deferred
Published
Jul 11, 2026, 4:17 AM
Modified
Jul 14, 2026, 3:16 PM

View source JSON

No data.

Updated
Aug 1, 2026, 12:00 PM

JSON