What the vulnerability does
01Description
The Members – Membership & User Role Editor Plugin plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 3.2.22 via the members_filter_protected_posts_for_rest. This makes it possible for unauthenticated attackers to extract determine the existence and exact count of access-restricted posts, and use per-page pagination as a boolean oracle to infer keywords and content contained within those hidden restricted posts.
Explanation of Vulnerability in Simple Terms
02Summary
The Members plugin for WordPress contains an information exposure vulnerability in versions up to 3.2.22. The plugin fails to properly restrict access to sensitive data, allowing unauthenticated attackers to read information they should not have access to. This affects user data and site configuration details. Site administrators should update the plugin immediately.
What an attacker can do
03Attacker Capabilities
Read sensitive user and site information without logging in.
Potential impact on your site
04Site Impact
User data and site configuration may be exposed to anyone visiting your site.
Conditions required to exploit
05Prerequisites
Network access to the WordPress site; no authentication or user interaction required.
Key dates
06Disclosure timeline
July 11, 2026
CVE published
