What the vulnerability does
01Description
The WP-Members Membership Plugin for WordPress is vulnerable to unauthorized file access in versions up to, and including, 3.5.4.4. This is due to storing user-uploaded files in predictable directories (wp-content/uploads/wpmembers/user_files/<user_id>/) without implementing proper access controls beyond basic directory listing protection (.htaccess with Options -Indexes). This makes it possible for unauthenticated attackers to directly access and download sensitive documents uploaded by site users via direct URL access, granted they can guess or enumerate user IDs and filenames.
Explanation of Vulnerability in Simple Terms
02Summary
WP-Members Membership Plugin versions 3.5.4.4 and earlier contain a file access vulnerability that allows unauthenticated attackers to read sensitive files on the server. The vulnerability requires no user interaction and can be exploited over the network. An attacker can access files that should be restricted, potentially exposing configuration data or other sensitive information.
What an attacker can do
03Attacker Capabilities
Read sensitive files on the server without authentication.
Potential impact on your site
04Site Impact
Attackers can access restricted files, potentially exposing database credentials, configuration, or other sensitive data.
Conditions required to exploit
05Prerequisites
Network access to the site; no authentication or user interaction required.
Key dates
06Disclosure timeline
January 7, 2026
CVE published
April 8, 2026
Record updated
