Members <= 3.2.22 - Unauthenticated Sensitive Information Disclosure via REST API Pagination Side Channel
Strategic Overview
- Status
- Patched in 3.2.23
- Affected Plugin
- Members – Membership & User Role Editor Plugin
- Affected Version
<= 3.2.22- CVSS
- 5.3Medium
- Weakness type
- CWE-200 · Exposure of Sensitive Information to an Unauthorized Actor
- CVE
CVE-2026-12426
At a glance
CVE-2026-12426 is a medium-severity Exposure of Sensitive Information to an Unauthorized Actor vulnerability in the Members WordPress plugin, affecting versions <= 3.2.22. It carries a CVSS score of 5.3 (reachable over the network; low attack complexity). Exploitation requires no authentication. The issue is fixed in version 3.2.23; sites on affected versions should update now. Disclosed July 2026, reported by Huazu Jiang (anjhz0318).
Vulnerability Overview
The Members – Membership & User Role Editor Plugin plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 3.2.22 via the members_filter_protected_posts_for_rest. This makes it possible for unauthenticated attackers to extract determine the existence and exact count of access-restricted posts, and use per-page pagination as a boolean oracle to infer keywords and content contained within those hidden restricted posts.
Technical Analysis
The vector marks this flaw as remotely reachable over the network, with low attack complexity — no special timing or configuration is needed, and no privileges on the target site, and no interaction from a victim user.
CWE-200: Exposure of Sensitive Information to an Unauthorized Actor
Reaching this weakness in Members <= 3.2.22 takes no account at all. Sensitive information exposure means data the application intended to keep internal is returned to a caller who should not be able to see it.
The disclosed data — credentials, tokens, customer records or internal paths — is usually worth more as material for a follow-up attack than as an end in itself. For Members the fix is 3.2.23: builds <= 3.2.22 are affected, anything from 3.2.23 onward is not.
Remediation
Update to version 3.2.23, or a newer patched version
How does WordSec protect against this?
This one needs no account at all, which puts it outside what login hardening can reach; WordSec's login security narrows the account-level paths around it, and the firewall is what inspects the request itself. None of that substitutes for the fix: Members 3.2.23 closes this, and updating the plugin is the step that ends it.
- Login Security
- Alerts
External References
Related records
Vulnerability data © Defiant, Inc., provided under the Wordfence Intelligence T&C