Membershipworks
Monthly
Member-only content gated by the MembershipWorks plugin for WordPress before 6.17 can be retrieved by unauthenticated visitors through the WordPress REST API, exposing posts and pages the plugin is meant to hide from non-members. The plugin's protected-content filter is only registered during normal front-end request handling, so REST responses return the raw rendered content instead of the stripped version; no authentication or user interaction is required, and only confidentiality of the gated content is affected (assessed CVSS:3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N, 8.7). No public exploit code has been identified at time of analysis, and the practical impact depends entirely on whether the site actually uses MembershipWorks content protection; sites in that configuration should plan to update this week.
Member-only content gated by the MembershipWorks plugin for WordPress before 6.17 can be retrieved by unauthenticated visitors through the WordPress REST API, exposing posts and pages the plugin is meant to hide from non-members. The plugin's protected-content filter is only registered during normal front-end request handling, so REST responses return the raw rendered content instead of the stripped version; no authentication or user interaction is required, and only confidentiality of the gated content is affected (assessed CVSS:3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N, 8.7). No public exploit code has been identified at time of analysis, and the practical impact depends entirely on whether the site actually uses MembershipWorks content protection; sites in that configuration should plan to update this week.