MemberGlut – Membership, Roles & Content Restriction
MemberGlut – Membership, Roles & Content Restriction has one disclosed vulnerability in the WordSec catalog, all reported in 2026; it is fixed as of October 2026. Their average CVSS score is 9.8, and the most serious one scores 9.8 out of 10. Severity breakdown: 1 critical and 0 high.
The most common weakness is Improper Privilege Management, behind 1 of the records (100%).
The one issue recorded for MemberGlut – Membership, Roles & Content Restriction has a vendor fix available, so running the current release closes it.
All of these findings were reported by moonge. The current release is tested up to WordPress 7.1.3.
CVE-2026-12394MemberGlut <= 1.1.4 - Unauthenticated Privilege Escalation
Read the full analysisVulnerability Records

MemberGlut – Membership, Roles & Content Restriction
Author
AppGlut
MemberGlut turns your WordPress site into a membership site in minutes. In short: ✅ Free and paid membership plans ✅ Stripe, PayPal and bank transfer payments ✅ Protect any post, page, category or the whole site ✅ A ready-made “My Account” page for members ✅ Registration, login and pricing pages in one click ✅ Full user role & capability editor ✅ 23 ready-to-use emails ✅ Everything below is free — no locked features 📦 Membership Plans Free or paid plans One-time payment or recurring (daily, weekly, monthly, yearly) Free trials Sign-up fees Limit the number of payments (e.g. 12 monthly payments) Access for a set time, until a date, for a calendar year, or forever Limit how many members can join a plan (“Sold out”) Choose who can buy a plan (anyone, new members, or members of other plans) Plan groups with upgrade and downgrade paths Upgrades start right away, downgrades at the end of the period Give a WordPress role with each plan Set a different role when the plan ends Duplicate, reorder, activate or deactivate plans Copy a sign-up link for any plan 💳 Payments Stripe: cards, Apple Pay, Google Pay, 3-D Secure PayPal: one-time payments and subscriptions Bank transfer with your own instructions Manual payments recorded by the admin Test mode for safe testing Automatic retries when a renewal payment fails Refunds from the admin (full or partial) Receipts and a thank-you page Members can update their card Payments list with filters, totals and CSV export 🏷️ Coupons Percent or fixed amount off Limit to certain plans Start and end dates Total uses and uses per member First payment only or every payment New customers only Import coupons from CSV 🔒 Content Restriction Protect posts, pages and custom post types Protect categories, tags and custom taxonomies Protect child pages, authors, page templates and URL patterns Make the whole site members-only (with public pages you choose) Per-post access settings in the block editor and classic editor Show a teaser, a custom message, a login form, or redirect Hide locked posts from blog lists, archives, search, sitemaps and the REST API Show or hide menu items and widgets by plan, role or login state Show or hide any block by plan or role “Members-only content” block and shortcode Rule tester: see what any user would see on any URL Administrators always keep access 👤 Member Account Page Dashboard with current memberships Edit profile (with email change confirmation) Change password View, cancel, renew and upgrade memberships Update payment card Payment history with receipts Login activity and “log out other devices” Delete account (optional) Turn each tab on or off 📝 Registration & Login Registration, login, lost password, account, pricing and thank-you pages created in one click Custom registration fields (text, select, checkbox, date, country and more) Login with email, username or both Password strength rules and strength meter Terms, privacy and GDPR consent checkboxes Approve new members manually or by email confirmation Custom login URL and redirect away from wp-login.php Redirects after login, logout and registration (also per role) Pricing table with cards, comparison or list layout 🛡️ Security Limit how many devices a member can use at once Lock out after too many failed logins Honeypot spam protection Google reCAPTCHA (v2 / v3), hCaptcha or Cloudflare Turnstile Hide the admin bar by role Block wp-admin by role Login history for every member 🔐 Privacy & GDPR WordPress “Export Personal Data” includes membership data WordPress “Erase Personal Data” removes or anonymises it Consent records with date and IP Suggested privacy policy text 👥 Members Management Members list with search, filters and bulk actions Add members and give or remove plans by hand Extend, put on hold, cancel or change a member’s plan Private notes on members Full activity history for every member Send an email to members of chosen plans Export members to CSV Turn existing users into members in one click 🎭 Roles & Capabilities Create, edit, clone and delete roles Add and remove capabilities Set the default role for new users Import and export roles ✉️ Emails 23 emails for members and admins (welcome, receipt, renewal, expiry, cancel…) Edit subject and text with smart tags Live preview and test send Reminders before expiry, renewal and trial end Your own sender name, address and footer 📊 Dashboard & Tools Dashboard: active members, revenue, MRR, churn and a 12-month chart Setup checklist for new sites Recent activity Export / import your setup to another site (settings, plans, rules, roles, emails, coupons) Logs and access log System status and Site Health checks Maintenance tools (run expirations, recount, sync roles, clear cache) 🧩 Shortcodes & Blocks [memberglut_register] — registration and checkout [memberglut_login] — login form [memberglut_account] — My Account page [memberglut_plans] — pricing table [memberglut_restrict]…[/memberglut_restrict] — members-only content [memberglut_member], [memberglut_expiry], [memberglut_members], [memberglut_count] and more Every shortcode is also a block ⚙️ For Developers REST API Template overrides in your theme 100+ actions and filters Background jobs with Action Scheduler Translation ready, RTL ready, WPML and Polylang compatible Works with caching plugins (member pages are never cached) Multisite compatible External services MemberGlut connects to the services below only when you turn them on. Nothing is sent to any of them by default. Stripe Used to take card payments when the Stripe gateway is enabled. When a member pays, their email, name, the plan and the amount are sent to Stripe from your server (api.stripe.com), and the Stripe.js library is loaded from js.stripe.com on the checkout and account pages so card details go straight to Stripe. Stripe sends payment notifications (webhooks) back to your site. Terms of service · Privacy policy PayPal Used to take PayPal payments when the PayPal gateway is enabled. The plan and amount (and the member’s email for subscriptions) are sent to PayPal from your server (api-m.paypal.com), and the PayPal JavaScript SDK is loaded from www.paypal.com on the checkout page. PayPal sends payment notifications (webhooks) back to your site. User agreement · Privacy statement Google reCAPTCHA Used when reCAPTCHA is chosen in Global Settings › Captcha, on the forms you select. The script is loaded from www.google.com and the visitor’s answer and IP address are sent to Google to be checked when the form is submitted. Terms of service · Privacy policy hCaptcha Used when hCaptcha is chosen in Global Settings › Captcha. The script is loaded from js.hcaptcha.com and the visitor’s answer and IP address are sent to hCaptcha (api.hcaptcha.com) when the form is submitted. Terms of service · Privacy policy Cloudflare Turnstile Used when Turnstile is chosen in Global Settings › Captcha. The script is loaded from challenges.cloudflare.com and the visitor’s answer and IP address are sent to Cloudflare when the form is submitted. Terms of service · Privacy policy
Vulnerability data © Defiant, Inc., provided under the Wordfence Intelligence T&C