The WP‑Members plugin suffers from a broken access control flaw that allows an attacker to exploit incorrectly configured security levels, bypassing authorization checks and gaining unauthorized access to protected content or functions within a WordPress site. This weakness can let a malicious actor read, create, or modify content that should be restricted to certain user roles, potentially exposing sensitive data or enabling further exploitation.

The vulnerability affects the WordPress WP‑Members plugin provided by RocketGeek, specifically all releases up through version 3.5.7. Any WordPress installation that has this plugin installed and is running a version at or below 3.5.7 is susceptible if its access control settings are not at the default secure configuration.

The CVSS score of 5.4 gives the flaw a moderate severity rating. Because the EPSS score is not available and the vulnerability is not listed in the CISA KEV catalog, the likelihood of widespread exploitation is unclear, but the potential impact to confidentiality and integrity is significant. The attack would typically involve making HTTP requests to the plugin’s endpoints from the browser or via automated scripts, relying on the fact that the plugin’s security levels have been misconfigured or left at a relaxed default. An attacker does not need elevated privileges beyond a standard user account to exploit the flaw, but the consequences can be far‑reaching when private content is exposed or administrative actions are performed.