{"id":"CVE-2026-12426","aliases":["EUVD-2026-43125","GHSA-5xr4-65q6-7jp8"],"status":"published","title":"Members \u003c= 3.2.22 - Unauthenticated Sensitive Information Disclosure via REST API Pagination Side Channel","description":"The Members – Membership \u0026 User Role Editor Plugin plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 3.2.22 via the members_filter_protected_posts_for_rest. This makes it possible for unauthenticated attackers to extract determine the existence and exact count of access-restricted posts, and use per-page pagination as a boolean oracle to infer keywords and content contained within those hidden restricted posts.","severity":{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","level":"medium","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-09","score":0.00475,"percentile":0.41303,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":false},"cwes":["CWE-200"],"published":"2026-07-11T02:31:18Z","modified":"2026-07-14T15:16:56Z","products":[{"vendor":"supercleanse","product":"members – membership \u0026 user role editor plugin"}],"references":[{"url":"https://www.wordfence.com/threat-intel/vulnerabilities/id/9c3557a6-aa72-496c-8515-2f6055de6b22?source=cve"},{"url":"https://plugins.trac.wordpress.org/browser/members/tags/3.2.22/inc/functions-content-permissions.php#L337"},{"url":"https://plugins.trac.wordpress.org/browser/members/tags/3.2.22/inc/functions-private-site.php#L42"},{"url":"https://plugins.trac.wordpress.org/browser/members/tags/3.2.19/inc/functions-content-permissions.php#L337"},{"url":"https://plugins.trac.wordpress.org/browser/members/tags/3.2.19/inc/functions-private-site.php#L42"},{"url":"https://plugins.trac.wordpress.org/changeset?sfp_email=\u0026sfph_mail=\u0026reponame=\u0026new=3594293%40members%2Ftrunk\u0026old=3552545%40members%2Ftrunk\u0026sfp_email=\u0026sfph_mail="},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-12426"},{"url":"https://github.com/advisories/GHSA-5xr4-65q6-7jp8"}],"sources":{"cve":[{"id":"CVE-2026-12426","title":"Members \u003c= 3.2.22 - Unauthenticated Sensitive Information Disclosure via REST API Pagination Side Channel","description":"The Members – Membership \u0026 User Role Editor Plugin plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 3.2.22 via the members_filter_protected_posts_for_rest. This makes it possible for unauthenticated attackers to extract determine the existence and exact count of access-restricted posts, and use per-page pagination as a boolean oracle to infer keywords and content contained within those hidden restricted posts.","status":"published","published":"2026-07-11T02:31:18.186Z","modified":"2026-07-14T14:18:17.164Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","level":"medium","assessor":"cna"}],"cwes":["CWE-200"],"updated_at":"2026-11-02T14:19:47.998488Z"}],"euvd":[{"id":"EUVD-2026-43125","description":"The Members – Membership \u0026 User Role Editor Plugin plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 3.2.22 via the members_filter_protected_posts_for_rest. This makes it possible for unauthenticated attackers to extract determine the existence and exact count of access-restricted posts, and use per-page pagination as a boolean oracle to infer keywords and content contained within those hidden restricted posts.","status":"published","published":"2026-07-11T02:31:18Z","modified":"2026-07-14T14:18:17Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","level":"medium"}],"updated_at":"2026-11-02T18:20:00.206712Z"}],"ghsa":[{"id":"GHSA-5xr4-65q6-7jp8","title":"The Members – Membership \u0026 User Role Editor Plugin plugin for WordPress is vulnerable to...","description":"The Members – Membership \u0026 User Role Editor Plugin plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 3.2.22 via the members_filter_protected_posts_for_rest. This makes it possible for unauthenticated attackers to extract determine the existence and exact count of access-restricted posts, and use per-page pagination as a boolean oracle to infer keywords and content contained within those hidden restricted posts.","status":"published","published":"2026-07-11T06:31:15Z","modified":"2026-07-11T06:31:23Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","level":"medium"}],"cwes":["CWE-200"],"updated_at":"2026-11-02T15:09:24.04976Z"}],"nvd":[{"id":"CVE-2026-12426","description":"The Members – Membership \u0026 User Role Editor Plugin plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 3.2.22 via the members_filter_protected_posts_for_rest. This makes it possible for unauthenticated attackers to extract determine the existence and exact count of access-restricted posts, and use per-page pagination as a boolean oracle to infer keywords and content contained within those hidden restricted posts.","status":"published","published":"2026-07-11T04:17:16.503Z","modified":"2026-07-14T15:16:56.847Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","level":"medium","assessor":"secondary"}],"cwes":["CWE-200"],"updated_at":"2026-11-02T14:12:28.771746Z"}]}}