EUVD-2026-92290
GHSA-vjwf-8fv5-9q2x
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessAuthenticate as low-privilege user
-
ExploitSend crafted request to plugin endpoint
-
ExecutionTrigger sensitive-information exposure
-
ImpactHarvest disclosed system data
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A01:2025 - Broken Access Control
ASVS 5.0
V14 - Data Protection System info exposure prevention
|
| Exploitation Conditions | Exploitation requires an authenticated session at a low privilege level (CVSS PR:L) against a WordPress site running the Memberful - Membership Plugin at version 1.81.2 or earlier; it is reachable over the network (AV:N) with low attack complexity and no user interaction. The key limiting factors are the authentication requirement (an attacker must already hold a valid low-privilege account, such as a registered member or subscriber), the confidentiality-only impact (no integrity or availability effect), and the limited scope of the data disclosed (C:L). The specific plugin feature or endpoint that leaks the sensitive data is not detailed in the available description. |
| Impact | This is a low-to-moderate priority issue despite being network-exploitable. The provided CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N, base 4.3, Medium) shows a network-reachable flaw that is easy to execute but requires low-level authentication (PR:L) and yields only limited confidentiality impact (C:L) with no integrity or availability consequences - consistent with CWE-497 (Exposure of Sensitive System Information). No EPSS score, CISA KEV listing, SSVC decision data, or public POC was provided in the input, so there is no signal of active or probable exploitation; the entry originates from a single Patchstack advisory. The signals are internally consistent (a disclosure-only bug requiring an authenticated session fits the C:L/PR:L profile), so there is no CVSS-versus-description conflict to flag - the main caveat is simply that exploitation-likelihood data (EPSS/KEV/POC) is absent, which limits confidence in real-world urgency rather than contradicting the severity. |
| Exploit ScenarioDerived | An attacker who holds a low-privilege authenticated account on a WordPress site running the Memberful plugin (≤1.81.2) sends a crafted request to a plugin endpoint and receives sensitive system or configuration information that should not be exposed to that privilege level. No public exploit code was identified, and the disclosed data is limited in scope (CVSS C:L), so the practical value is reconnaissance or aiding a follow-on attack rather than direct compromise. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 05, 2026
WordPress sites running the Memberful - Membership Plugin (memberful-wp) through version 1.81.2 can expose sensitive system information to any authenticated user holding a low-privilege account, such as a subscriber or registered member. The flaw is reachable over the network with low attack complexity and requires no user interaction, but the impact is confidentiality-only and limited in scope (CVSS 4.3, C:L), making this a low-to-moderate priority hardening item rather than an emergency patch. No public exploit code was identified at time of analysis, and the vulnerability is not known to be actively exploited.
RemediationAI
No vendor-released patch or fixed version is identified in the provided intelligence, so the primary action is to track the Patchstack advisory at https://patchstack.com/database/wordpress/plugin/memberful-wp/vulnerability/wordpress-memberful-membership-plugin-plugin-1-81-2-sensitive-data-exposure-vulnerability?_s_id=cve and apply the vendor-released update as soon as a version later than 1.81.2 becomes available. In the interim, reduce the attack surface that the vulnerability depends on: restrict who can hold an account on the site by disabling open registration and approving new members manually, audit the existing user list for unnecessary subscriber/member accounts and remove or downgrade any that are not required, because the exploit prerequisite is a valid low-privilege authenticated session (PR:L) and eliminating that foothold removes the exploit path entirely. If the site does not use Memberful, deactivate and delete the plugin; deactivation removes all of its endpoints but also removes membership, subscription, and gated-content functionality, and any Memberful sync will stop. Where the plugin is required, place the WordPress login and membership pages behind a WAF rule set that rate-limits or blocks enumerated authenticated requests returning large or unexpected response bodies, accepting the trade-off of possible false positives on legitimate member traffic. WordPress hardening such as enforcing role least-privilege and reviewing any custom code that calls Memberful plugin functions is also warranted, but note that none of these compensating controls address the underlying missing authorization check - they only shrink the population of users able to trigger it - so patching remains the only complete fix.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The issue is an instance of CWE-497, Exposure of Sensitive System Information to an Unauthorized Control Sphere, implemented in a WordPress plugin context. WordPress plugins run inside the CMS process and rely on the platform's capability and nonce system to gate access to data; CWE-497 typically arises when an AJAX action, REST route, shortcode handler, or rendered template returns server-side information (configuration values, environment or path details, internal identifiers, or membership/account metadata held by the plugin) without verifying that the requesting user is entitled to see it. Memberful - Membership Plugin integrates WordPress with the Memberful membership platform, so it handles member records, subscription state, and service credentials, and any endpoint that returns such data is a candidate for this disclosure class. The CPE entry cpe:2.3:a:memberful:memberful_-_membership_plugin:*:*:*:*:*:*:*:* confirms the affected component is the plugin itself across all tracked releases, with version 1.81.2 as the last affected release per the advisory. The precise parameter, endpoint, or data field that leaks the information is not disclosed in the available description, and the vulnerability record is attributed to Patchstack, which published the original advisory. Per the assessed vector (AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N), the defect is exploitable remotely by an authenticated low-privilege user, affects only confidentiality, and does not cross a scope boundary or affect integrity or availability.
Know when Wordpress Plugin gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
Network-reachable (AV:N) and easy to execute (AC:L) but requires an authenticated low-privilege account (PR:L); disclosure-only CWE-497 yields limited confidentiality (C:L) with no integrity or availability impact.
Primary rating from Vendor (Patchstack).
CVSS VectorVendor: Patchstack
DescriptionCVE.org
Exposure of Sensitive System Information to an Unauthorized Control Sphere vulnerability in Memberful Memberful - Membership Plugin memberful-wp allows Retrieve Embedded Sensitive Data.This issue affects Memberful - Membership Plugin: from n/a through 1.81.2.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Information disclosure occurs when an application unintentionally exposes sensitive data that aids attackers in reconnaissance or directly compromises security.
More in Wordpress Plugin
View allThe Backup Migration plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 1
The Hash Form - Drag & Drop Form Builder plugin for WordPress is vulnerable to arbitrary file uploads due to missing fil
Authentication bypass in the LiteSpeed Cache WordPress plugin (versions prior to 6.5.0.1) allows unauthenticated remote
The Simple File List plugin for WordPress through version 4.2.2 contains an unauthenticated remote code execution vulner
The SureTriggers WordPress plugin through version 1.0.82 contains a privilege escalation vulnerability that allows unaut
The Ninja Forms plugin before 2.9.42.1 for WordPress allows remote attackers to conduct PHP object injection attacks via
The Business Directory Plugin - Easy Listing Directories for WordPress plugin for WordPress is vulnerable to time-based
SQL injection in the NotificationX WordPress plugin (versions up to and including 2.8.2) allows unauthenticated remote a
The POST SMTP Mailer - Email log, Delivery Failure Notifications and Best Mail SMTP for WordPress plugin for WordPress i
The MasterStudy LMS WordPress Plugin - for Online Courses and Education plugin for WordPress is vulnerable to union base
The Email Subscribers by Icegram Express plugin for WordPress is vulnerable to SQL Injection via the ‘hash’ parameter in
Remote code execution in the WP Query Console WordPress plugin (versions up to and including 1.0) by Ajit Bohra allows u
Exploit-DB