MembershipWorks EUVD-2026-111368

Exploitable only when the MembershipWorks plugin (before 6.17) is installed and active and the site exposes WordPress REST API endpoints (enabled by default) while using the plugin's content-protection feature to restrict posts/pages to members. The specific condition from the description is that the plugin's protected-content filter is attached only during front-end request handling and not during REST API requests, so retrieving a protected post via the REST API returns its raw rendered content. Limiting factors: only confidentiality of member-only content is affected (no modification or availability impact); the site must actually use MembershipWorks content gating for there to be anything to disclose; sites that disable or restrict the REST API would blunt this vector. No authentication or user interaction is required (PR:N/UI:N).

This is a genuine priority for anyone running the affected plugin, though the signals are moderate rather than critical. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N) describes fully remote, unauthenticated, low-complexity access with no user interaction and no attack-requirement constraint - meaning any internet-facing WordPress site running MembershipWorks before 6.17 is reachable. Impact is confidentiality-only: VC:H with VI:N/VA:N confirms the flaw discloses protected data but does not let an attacker modify or disrupt the system, which is consistent with the CWE-862 (missing authorization) classification and the information-disclosure description. The vuln.today decision label is 'this_week' (not act_now/emergency), aligning with a serious-but-not-fire-drill posture. KEV status is not listed, so there is no evidence of active exploitation, and no EPSS probability was supplied to gauge likelihood of mass exploitation - this missing EPSS data is a real gap. A VulnCheck advisory documents the issue but the input does not flag confirmed working exploit code. Net: high-confidence, trivially reachable data exposure on affected installs, but scoped to confidentiality and not yet shown to be exploited in the wild - patch this week as the decision label indicates.

An unauthenticated attacker requests a protected post or page through the WordPress REST API (e.g. /wp-json/wp/v2/posts) instead of the normal front-end URL. Because the plugin only attaches its content-stripping filter during front-end request handling, the REST response returns the raw member-only content, and the attacker reads paywalled or members-only material without any account. No public working exploit code is confirmed in the input, but the attack requires only standard HTTP requests against default REST API endpoints.