CVE-2025-14844

Description

The Membership Plugin – Restrict Content plugin for WordPress is vulnerable to Missing Authentication in all versions up to, and including, 3.2.16 via the 'rcp_stripe_create_setup_intent_for_saved_card' function due to missing capability check. Additionally, the plugin does not check a user-controlled key, which makes it possible for unauthenticated attackers to leak Stripe SetupIntent client_secret values for any membership.

PUBLISHED Reserved 2025-12-17 | Published 2026-01-16 | Updated 2026-01-16 | Assigner Wordfence

Problem types

CWE-639 Authorization Bypass Through User-Controlled Key

Product status

Timeline

Credits

andrea bocchetti finder

References

www.wordfence.com/...-c7cd-469f-bccf-90e8b52fd4e7?source=cve

plugins.trac.wordpress.org/.../gateways/stripe/functions.php

plugins.trac.wordpress.org/.../gateways/stripe/functions.php

docs.stripe.com/api/setup_intents/object

cwe.mitre.org/data/definitions/639.html

plugins.trac.wordpress.org/.../gateways/stripe/functions.php

cve.org (CVE-2025-14844)

nvd.nist.gov (CVE-2025-14844)

Download JSON