CVE-2026-12426

Description

The Members – Membership & User Role Editor Plugin plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 3.2.22 via the members_filter_protected_posts_for_rest. This makes it possible for unauthenticated attackers to extract determine the existence and exact count of access-restricted posts, and use per-page pagination as a boolean oracle to infer keywords and content contained within those hidden restricted posts.

PUBLISHED Reserved 2026-06-16 | Published 2026-07-11 | Updated 2026-07-14 | Assigner Wordfence

Problem types

CWE-200 Exposure of Sensitive Information to an Unauthorized Actor

Product status

Timeline

Credits

Huazu Jiang (anjhz0318) finder

References

www.wordfence.com/...-aa72-496c-8515-2f6055de6b22?source=cve

plugins.trac.wordpress.org/...ctions-content-permissions.php

plugins.trac.wordpress.org/...inc/functions-private-site.php

plugins.trac.wordpress.org/...ctions-content-permissions.php

plugins.trac.wordpress.org/...inc/functions-private-site.php

plugins.trac.wordpress.org/...%2Ftrunk&sfp_email=&sfph_mail=

cve.org (CVE-2026-12426)

nvd.nist.gov (CVE-2026-12426)

Download JSON