What is the CVSS score of CVE-2026-12426?

CVE-2026-12426 has a CVSS 3.1 base score of 5.3 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N. EPSS exploitation probability: 0.3%.

Members Plugin CVE-2026-12426

EUVD-2026-43125 MEDIUM

Information Exposure (CWE-200)

2026-07-11 Wordfence

GHSA-5xr4-65q6-7jp8

WordPress Information Disclosure Oracle Wordpress Plugin Members Membership User Role Editor Plugin

5.3

CVSS 3.1 · Vendor: Wordfence

Severity by source

Vendor (Wordfence) PRIMARY

5.3 MEDIUM

AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

vuln.today AI

5.3 MEDIUM

REST API endpoint is network-accessible with no authentication required; confidentiality impact is low because only metadata and inferred keywords are exposed, not post content directly.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (Wordfence).

CVSS VectorVendor: Wordfence

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

Low

Integrity

None

Availability

None

Lifecycle Timeline

Analysis Generated

Jul 11, 2026 - 03:51 vuln.today

CVE Published

Jul 11, 2026 - 02:31 cve.org

MEDIUM 5.3

DescriptionCVE.org

The Members - Membership & User Role Editor Plugin plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 3.2.22 via the members_filter_protected_posts_for_rest. This makes it possible for unauthenticated attackers to extract determine the existence and exact count of access-restricted posts, and use per-page pagination as a boolean oracle to infer keywords and content contained within those hidden restricted posts.

AnalysisAI

Sensitive information exposure in the Members - Membership & User Role Editor Plugin for WordPress (all versions through 3.2.22) allows unauthenticated network attackers to exploit the REST API filter members_filter_protected_posts_for_rest as a boolean oracle, revealing the existence, count, and inferred keyword content of posts explicitly restricted by membership rules. The mechanism abuses per-page pagination parameters to observe response count changes, enabling iterative inference of hidden post content without ever receiving the post body directly. No public exploit code has been identified at time of analysis, and this is not listed in CISA KEV, but the zero-authentication, network-accessible attack surface means any WordPress site using this plugin with sensitive restricted content is exposed by default.

Technical ContextAI

The vulnerability resides in the Members plugin for WordPress (CPE: cpe:2.3:a:supercleanse:members_-_membership_&_user_role_editor_plugin:*:*:*:*:*:*:*:*), a popular plugin for managing membership tiers and user roles. The flaw is located in two files: inc/functions-content-permissions.php (line 337) and inc/functions-private-site.php (line 42), both reachable via the WordPress REST API through the members_filter_protected_posts_for_rest filter hook. CWE-200 (Exposure of Sensitive Information to an Unauthorized Actor) describes the root cause: the REST API leaks metadata about access-restricted posts - their existence and total count - even to unauthenticated callers. Because WordPress REST endpoints support per_page pagination, an attacker can manipulate this parameter alongside keyword queries to observe changes in the returned count, turning the endpoint into a boolean oracle. This is a classic side-channel technique: the attacker never reads post content directly but deduces it through systematic probing of response metadata.

RemediationAI

Update the Members plugin to a version above 3.2.22 as soon as a released patched version is available. An upstream fix has been committed to the plugin's SVN trunk (changeset comparing r3552545 to r3594293, viewable at https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&new=3594293%40members%2Ftrunk&old=3552545%40members%2Ftrunk), but the exact released version number incorporating this fix is not confirmed from available data - verify directly in the WordPress plugin directory before updating. As a compensating control while awaiting a stable patched release, administrators can restrict unauthenticated access to the WordPress REST API using a security plugin (e.g., Wordfence, Disable REST API) or server-level rules returning 401/403 for unauthenticated REST requests; note this may disrupt Gutenberg editor functionality and any REST-dependent integrations. A narrower alternative is to audit whether any posts with Members content restrictions contain genuinely sensitive data, and temporarily remove restrictions from low-sensitivity posts to reduce oracle utility until patched.