CVE-2023-47668 MEDIUM

CVE-2023-47668: WordPress Restrict Content Plugin <= 3.2.7 is vulnerable to Sensitive Data Exposure

Vendor Stellarwp
Product Membership Plugin – Restrict Content
Weakness CWE-200 · Info exposure
Published November 23, 2023
Last update April 28, 2026
View on NVD All CVEs

CVSS base score

5.3/10
Attack vector Network
Attack complexity Low
Privileges required None
User interaction None
Confidentiality Low
Integrity None

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

What the vulnerability does

01Description

Exposure of Sensitive Information to an Unauthorized Actor vulnerability in StellarWP Membership Plugin – Restrict Content plugin <= 3.2.7 versions.

Explanation of Vulnerability in Simple Terms

02Summary

The Membership Plugin – Restrict Content for WordPress contains an information exposure vulnerability in versions up to 3.2.7. The plugin fails to properly restrict access to sensitive data, allowing unauthenticated attackers to read information that should be protected. This affects sites using the plugin without additional access controls. Update to a version newer than 3.2.7 to resolve the issue.

What an attacker can do

03Attacker Capabilities

Read sensitive information that should be restricted to authorized users.

Potential impact on your site

04Site Impact

Unauthorized visitors can access protected content or data meant only for members.

Conditions required to exploit

05Prerequisites

Network access only; no authentication or user interaction required.

Key dates

06Disclosure timeline

November 23, 2023 CVE published
April 28, 2026 Record updated

Related vulnerabilities

08Related CVE

CVE-2026-16773 WPBot <= 8.5.9 - Unauthenticated Sensitive Information Exposure in 'wpbot_send_email_transcript' AJAX Action CVE-2025-14726 Widgets for Social Photo Feed <= 1.8 - Missing Authentication to Unauthenticated Plugin Settings Access/Update via trustindex_feed_hook_instagram REST API endpoints CVE-2026-60031 Joomla Extension - themexpert.com - Information disclosure in Quix Page Builder < 6.2.1 CVE-2026-5032 W3 Total Cache <= 2.9.3 - Unauthenticated Security Token Exposure via User-Agent Header CVE-2026-2268 Ninja Forms <= 3.14.0 - Unauthenticated Information Disclosure in nf_ajax_submit AJAX Action