The vulnerability allows unauthenticated attackers to access Membership For WooCommerce REST routes because the plugin does not verify that a consumer secret is present before comparing it to the secret supplied in a request. As a result, visitors can retrieve membership plan details of site users, exposing sensitive subscription information. This defect is a moderate severity vulnerability (CVSS 5.3) that compromises confidentiality but does not provide code execution or denial of service.

WordPress sites running the Membership For WooCommerce plugin earlier than version 3.1.2 are affected. The flaw occurs when the plugin’s REST API is enabled but the administrator has not created any API consumer keys, a configuration that can happen on sites that install the plugin but do not use its API functionality.

The CVSS score of 5.3 indicates a moderate risk, while the EPSS score of < 1% suggests a very low likelihood of exploitation in the wild. The vulnerability is not listed in the CISA KEV catalog. Attackers can exploit the flaw remotely by sending unauthenticated HTTP requests to the plugin’s REST endpoints; no authentication or special privileges are required because consumer secret validation is not enforced.